Deep Security Center
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)
DNS Client
1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
1007605* - BOX (ATT&CK T1102.002, T1567.002)
1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1002103* - AOL Instant Messenger (ATT&CK T1102.002)
1004663* - IP Messenger (ATT&CK T1102.002)
1002507* - Jabber (ATT&CK T1102.002)
1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
1002162* - MSN Messenger (ATT&CK T1102.002)
1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
1004941* - QQ Messenger (ATT&CK T1102.002)
Mail Client Applications
1001112* - SMTP Client (ATT&CK T1071.003)
Remote Login Applications
1002508* - RDP (ATT&CK T1021.001)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)
SSL/TLS Server
1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)
Suspicious Client Application Activity
1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)
Suspicious Server Application Activity
1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)
Trend Micro OfficeScan
1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Application PHP Based
1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
1004302* - Microsoft Windows Shortcut Remote Code Execution
Web Server Common
1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)
Web Server HTTPS
1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server SharePoint
1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
Zoho ManageEngine
1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)
DNS Client
1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
1007605* - BOX (ATT&CK T1102.002, T1567.002)
1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1002103* - AOL Instant Messenger (ATT&CK T1102.002)
1004663* - IP Messenger (ATT&CK T1102.002)
1002507* - Jabber (ATT&CK T1102.002)
1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
1002162* - MSN Messenger (ATT&CK T1102.002)
1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
1004941* - QQ Messenger (ATT&CK T1102.002)
Mail Client Applications
1001112* - SMTP Client (ATT&CK T1071.003)
Remote Login Applications
1002508* - RDP (ATT&CK T1021.001)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)
SSL/TLS Server
1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)
Suspicious Client Application Activity
1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)
Suspicious Server Application Activity
1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)
Trend Micro OfficeScan
1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Application PHP Based
1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
1004302* - Microsoft Windows Shortcut Remote Code Execution
Web Server Common
1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)
Web Server HTTPS
1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server SharePoint
1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
Zoho ManageEngine
1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)
DCERPC Services - Client
1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)
Directory Server LDAP
1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)
Remote Desktop Protocol Server
1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)
Suspicious Server Application Activity
1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)
Unix SSH
1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)
Web Client SharePoint
1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)
Web Media Applications
1009913* - Identified Pastebin Communication (ATT&CK T1102.002)
Web Server Common
1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)
Web Server HTTPS
1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
Web Server Nagios
1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)
Windows Remote Management
1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)
Windows Remote Management Client
1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)
Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)
Integrity Monitoring Rules:
1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
1003573* - Linux/Unix - File attributes in the /bin directory modified
1003513* - Linux/Unix - File attributes in the /etc directory modified
1003514* - Linux/Unix - File attributes in the /lib directory modified
1003574* - Linux/Unix - File attributes in the /sbin directory modified
1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)
DCERPC Services - Client
1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)
Directory Server LDAP
1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)
Remote Desktop Protocol Server
1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)
Suspicious Server Application Activity
1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)
Unix SSH
1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)
Web Client SharePoint
1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)
Web Media Applications
1009913* - Identified Pastebin Communication (ATT&CK T1102.002)
Web Server Common
1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)
Web Server HTTPS
1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
Web Server Nagios
1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)
Windows Remote Management
1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)
Windows Remote Management Client
1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)
Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)
Integrity Monitoring Rules:
1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
1003573* - Linux/Unix - File attributes in the /bin directory modified
1003513* - Linux/Unix - File attributes in the /etc directory modified
1003514* - Linux/Unix - File attributes in the /lib directory modified
1003574* - Linux/Unix - File attributes in the /sbin directory modified
1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Pulsar Binary Protocol
1010998* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)
Web Application Common
1011047 - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011043 - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
Web Client Common
1011048 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21166)
1011049 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)
Web Client Internet Explorer/Edge
1010133* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674)
Web Server HTTPS
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011035 - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
1011028* - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)
Web Server Nagios
1011023* - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
1011022 - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011030* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Pulsar Binary Protocol
1010998* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)
Web Application Common
1011047 - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011043 - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
Web Client Common
1011048 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21166)
1011049 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)
Web Client Internet Explorer/Edge
1010133* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674)
Web Server HTTPS
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011035 - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
1011028* - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)
Web Server Nagios
1011023* - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
1011022 - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011030* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Oracle E-Business Suite Web Interface
1011019* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)
Pulsar Binary Protocol
1010998 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)
Web Client Common
1011032 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
Web Client Internet Explorer/Edge
1011040 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34448)
Web Server Common
1009705* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2019-3396)
Web Server HTTPS
1011041 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011028 - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)
Web Server Nagios
1011023 - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
Web Server SharePoint
1011030 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)
Windows Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Zoho ManageEngine
1011020* - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
Integrity Monitoring Rules:
1002875* - Linux/Unix - Software installed, updated or removed
1010373* - Linux/Unix - Systemd service modified (ATT&CK T1543.002)
1010791 - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
1009622* - Linux/Unix - bash non-root user configuration files modified (ATT&CK T1546.004)
1011021 - Linux/Unix - bash root user configuration files modified (ATT&CK T1546.004)
Log Inspection Rules:
1011042 - SolarWinds Serv-U SSH EXCEPTION (CVE-2021-35211)
Deep Packet Inspection Rules:
Oracle E-Business Suite Web Interface
1011019* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)
Pulsar Binary Protocol
1010998 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)
Web Client Common
1011032 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
Web Client Internet Explorer/Edge
1011040 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34448)
Web Server Common
1009705* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2019-3396)
Web Server HTTPS
1011041 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011028 - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)
Web Server Nagios
1011023 - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
Web Server SharePoint
1011030 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)
Windows Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Zoho ManageEngine
1011020* - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
Integrity Monitoring Rules:
1002875* - Linux/Unix - Software installed, updated or removed
1010373* - Linux/Unix - Systemd service modified (ATT&CK T1543.002)
1010791 - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
1009622* - Linux/Unix - bash non-root user configuration files modified (ATT&CK T1546.004)
1011021 - Linux/Unix - bash root user configuration files modified (ATT&CK T1546.004)
Log Inspection Rules:
1011042 - SolarWinds Serv-U SSH EXCEPTION (CVE-2021-35211)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Directory Server LDAP
1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Oracle E-Business Suite Web Interface
1010999* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
1011019 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)
Port Mapper Windows
1001033* - Windows Port Mapper Decoder
Web Application Common
1005934* - Identified Suspicious Command Injection Attack
Web Application PHP Based
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Server Apache
1010997* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)
Web Server HTTPS
1011015* - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability
Windows SMB Server
1011018* - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol
Windows Services RPC Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Zoho ManageEngine
1011020 - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
1011012* - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Directory Server LDAP
1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Oracle E-Business Suite Web Interface
1010999* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
1011019 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)
Port Mapper Windows
1001033* - Windows Port Mapper Decoder
Web Application Common
1005934* - Identified Suspicious Command Injection Attack
Web Application PHP Based
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Server Apache
1010997* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)
Web Server HTTPS
1011015* - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability
Windows SMB Server
1011018* - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol
Windows Services RPC Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Zoho ManageEngine
1011020 - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
1011012* - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Port Mapper Windows
1001033* - Windows Port Mapper Decoder
Windows SMB Server
1011018 - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol
Windows Services RPC Server DCERPC
1011016 - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1011017 - Microsoft Windows - Print Spooler Failed Loading Plugin Module (PrintNightmare)
Deep Packet Inspection Rules:
Port Mapper Windows
1001033* - Windows Port Mapper Decoder
Windows SMB Server
1011018 - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol
Windows Services RPC Server DCERPC
1011016 - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1011017 - Microsoft Windows - Print Spooler Failed Loading Plugin Module (PrintNightmare)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DNS Server
1010986* - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)
Directory Server LDAP
1011008 - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Oracle E-Business Suite Web Interface
1010999 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
Web Application PHP Based
1011013 - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010711* - Google Chrome Buffer Overflow Vulnerability (CVE-2019-5782)
1011007 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-695)
1011006 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-697)
1011005 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-699)
1011004 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-701)
1011002 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-703)
1011001 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-704)
1011000 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-705)
1011003 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-21-702)
1011011 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-696)
1011010 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-698)
1011009 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-700)
Web Server Apache
1010997 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)
Web Server Common
1010980* - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
1010985* - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)
Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
1011015 - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability
Zoho ManageEngine
1011012 - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability
Integrity Monitoring Rules:
1010843 - Linux/Unix - Boot files modified (ATT&CK T1542)
1010845 - Linux/Unix - Default firewall rules modified (ATT&CK T1562.004)
1010846 - Linux/Unix - Disk configuration files modified (ATT&CK T1561.002)
1010847 - Linux/Unix - SSL configuration files modified (ATT&CK T1587.003)
1010793 - Linux/Unix - Shared object files modified
1010856 - Linux/Unix - Static boot loader files modified (ATT&CK T1542)
1010848 - Linux/Unix - User access control files modified (ATT&CK T1068)
1010844 - Linux/Unix - modeprobe configuration files modified (ATT&CK T1547.006)
Log Inspection Rules:
1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001)
Deep Packet Inspection Rules:
DNS Server
1010986* - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)
Directory Server LDAP
1011008 - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Oracle E-Business Suite Web Interface
1010999 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
Web Application PHP Based
1011013 - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010711* - Google Chrome Buffer Overflow Vulnerability (CVE-2019-5782)
1011007 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-695)
1011006 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-697)
1011005 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-699)
1011004 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-701)
1011002 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-703)
1011001 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-704)
1011000 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-705)
1011003 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-21-702)
1011011 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-696)
1011010 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-698)
1011009 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-700)
Web Server Apache
1010997 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)
Web Server Common
1010980* - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
1010985* - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)
Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
1011015 - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability
Zoho ManageEngine
1011012 - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability
Integrity Monitoring Rules:
1010843 - Linux/Unix - Boot files modified (ATT&CK T1542)
1010845 - Linux/Unix - Default firewall rules modified (ATT&CK T1562.004)
1010846 - Linux/Unix - Disk configuration files modified (ATT&CK T1561.002)
1010847 - Linux/Unix - SSL configuration files modified (ATT&CK T1587.003)
1010793 - Linux/Unix - Shared object files modified
1010856 - Linux/Unix - Static boot loader files modified (ATT&CK T1542)
1010848 - Linux/Unix - User access control files modified (ATT&CK T1068)
1010844 - Linux/Unix - modeprobe configuration files modified (ATT&CK T1547.006)
Log Inspection Rules:
1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DNS Server
1010986 - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)
Microsoft Office
1010991 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-31939)
1010992 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-31941)
Web Application PHP Based
1010993 - WordPress 'Directories Pro' Plugin Cross-Site Scripting Vulnerability (CVE-2020-29304)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010974* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-37)
1010978* - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010995 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31945)
1010994 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31946)
1010996 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31983)
1010987 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-27068)
Web Server Common
1010985 - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)
Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Web Server Oracle
1005128* - Oracle Business Transaction Management Server 'FlashTunnelService' WriteToFile Message Remote Code Execution
Web Server SharePoint
1010947* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-31181)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DNS Server
1010986 - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)
Microsoft Office
1010991 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-31939)
1010992 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-31941)
Web Application PHP Based
1010993 - WordPress 'Directories Pro' Plugin Cross-Site Scripting Vulnerability (CVE-2020-29304)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010974* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-37)
1010978* - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010995 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31945)
1010994 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31946)
1010996 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31983)
1010987 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-27068)
Web Server Common
1010985 - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)
Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Web Server Oracle
1005128* - Oracle Business Transaction Management Server 'FlashTunnelService' WriteToFile Message Remote Code Execution
Web Server SharePoint
1010947* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-31181)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1010900* - Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2021-28325)
SolarWinds Orion NPM
1010975 - SolarWinds Orion Job Scheduler Remote Code Execution Vulnerability (CVE-2021-31475)
Web Application PHP Based
1010982 - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010978 - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010984 - Microsoft Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2021-33739)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server Common
1010980 - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
Web Server HTTPS
1010983 - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1010976 - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Integrity Monitoring Rules:
1010821 - Linux/Unix - Alternative commands modified (ATT&CK T1036)
1010842 - Linux/Unix - Boot loader configuration files modified (ATT&CK T1542)
1010838 - Linux/Unix - Core system configuration files modified
1010979 - Linux/Unix - FTP client process initiated (ATT&CK T1048)
1010840 - Linux/Unix - Host access control files modified (ATT&CK T1584.004)
1010964 - Linux/Unix - Internet routing information file modified
1010963 - Linux/Unix - Kernel configuration files modified (ATT&CK T1547.006)
1010809 - Linux/Unix - List of valid login shells modified (ATT&CK T1059.004)
1010798 - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
1010839 - Linux/Unix - Name of the local system modified (ATT&CK T1082)
1010812 - Linux/Unix - Name resolver configuration files modified (ATT&CK T1071.004, T1583.002)
1010962 - Linux/Unix - Network services configuration files modified
1010813 - Linux/Unix - PAM configuration files modified (ATT&CK T1068)
1010853 - Linux/Unix - Process initialization scripts and configuration files modified (ATT&CK 1037)
1010817 - Linux/Unix - Run control (rc) scripts modified (ATT&CK T1037.004)
1010815 - Linux/Unix - Samba configuration files modified (ATT&CK T1135)
1010824 - Linux/Unix - Software repository modified (ATT&CK T1195.002)
1010807 - Linux/Unix - System wide environment variables and startup scripts modified (ATT&CK T1546.004)
1010825 - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
1010808 - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
1010827 - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
1010826 - Linux/Unix - dhclient configuration files modified
1010841 - Linux/Unix - ftpd configuration files modified (ATT&CK T1048, T1071.002)
1010805 - Linux/Unix - runtime linker configuration files modified
1010950 - Linux/Unix - sudo files modified (ATT&CK T1548.003)
1010819 - Linux/Unix - xinetd configuration files modified
1010828 - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1010900* - Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2021-28325)
SolarWinds Orion NPM
1010975 - SolarWinds Orion Job Scheduler Remote Code Execution Vulnerability (CVE-2021-31475)
Web Application PHP Based
1010982 - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010978 - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010984 - Microsoft Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2021-33739)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server Common
1010980 - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
Web Server HTTPS
1010983 - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1010976 - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Integrity Monitoring Rules:
1010821 - Linux/Unix - Alternative commands modified (ATT&CK T1036)
1010842 - Linux/Unix - Boot loader configuration files modified (ATT&CK T1542)
1010838 - Linux/Unix - Core system configuration files modified
1010979 - Linux/Unix - FTP client process initiated (ATT&CK T1048)
1010840 - Linux/Unix - Host access control files modified (ATT&CK T1584.004)
1010964 - Linux/Unix - Internet routing information file modified
1010963 - Linux/Unix - Kernel configuration files modified (ATT&CK T1547.006)
1010809 - Linux/Unix - List of valid login shells modified (ATT&CK T1059.004)
1010798 - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
1010839 - Linux/Unix - Name of the local system modified (ATT&CK T1082)
1010812 - Linux/Unix - Name resolver configuration files modified (ATT&CK T1071.004, T1583.002)
1010962 - Linux/Unix - Network services configuration files modified
1010813 - Linux/Unix - PAM configuration files modified (ATT&CK T1068)
1010853 - Linux/Unix - Process initialization scripts and configuration files modified (ATT&CK 1037)
1010817 - Linux/Unix - Run control (rc) scripts modified (ATT&CK T1037.004)
1010815 - Linux/Unix - Samba configuration files modified (ATT&CK T1135)
1010824 - Linux/Unix - Software repository modified (ATT&CK T1195.002)
1010807 - Linux/Unix - System wide environment variables and startup scripts modified (ATT&CK T1546.004)
1010825 - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
1010808 - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
1010827 - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
1010826 - Linux/Unix - dhclient configuration files modified
1010841 - Linux/Unix - ftpd configuration files modified (ATT&CK T1048, T1071.002)
1010805 - Linux/Unix - runtime linker configuration files modified
1010950 - Linux/Unix - sudo files modified (ATT&CK T1548.003)
1010819 - Linux/Unix - xinetd configuration files modified
1010828 - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Alibaba Nacos
1010971* - Alibaba Nacos AuthFilter Authentication Bypass Vulnerability (CVE-2021-29441)
Directory Server LDAP
1010970* - OpenLDAP Slapd Search Parsing Denial Of Service Vulnerability (CVE-2021-27212)
Mail Server Exim
1010973* - Exim Mail Server Integer Overflow Vulnerability (CVE-2020-28020)
Microsoft Office
1010977 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-31176)
Web Client Common
1010974 - Adobe Acrobat And Reader Out-Of-Bounds Read Vulnerability (CVE-2021-28554)
Web Client Internet Explorer/Edge
1010981 - Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2021-31959)
Web Server Miscellaneous
1010670* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2020-17530)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1002795* - Microsoft Windows Events
Deep Packet Inspection Rules:
Alibaba Nacos
1010971* - Alibaba Nacos AuthFilter Authentication Bypass Vulnerability (CVE-2021-29441)
Directory Server LDAP
1010970* - OpenLDAP Slapd Search Parsing Denial Of Service Vulnerability (CVE-2021-27212)
Mail Server Exim
1010973* - Exim Mail Server Integer Overflow Vulnerability (CVE-2020-28020)
Microsoft Office
1010977 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-31176)
Web Client Common
1010974 - Adobe Acrobat And Reader Out-Of-Bounds Read Vulnerability (CVE-2021-28554)
Web Client Internet Explorer/Edge
1010981 - Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2021-31959)
Web Server Miscellaneous
1010670* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2020-17530)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1002795* - Microsoft Windows Events