19-057 (November 19, 2019)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1003984* - SMB NTLM Authentication Lack Of Entropy Vulnerability


DCERPC Services - Client
1006994* - Executable File Download On Network Share Detected


DHCP Failover Protocol Server
1009887* - Microsoft Windows DHCP Server Remote Code Execution Vulnerability (CVE-2019-0785)


Database Oracle
1001141* - Oracle Database Server Core RDBMS Component Denial Of Service


HP Intelligent Management Center (IMC)
1008969* - HPE Intelligent Management Center Multiple Expression Language Injection Vulnerabilities
1009456* - HPE Intelligent Management Center Remote Code Execution Vulnerability (CVE-2017-12525)


Remote Login Applications
1004364* - TeamViewer (ATT&CK T1219)


Suspicious Client Application Activity
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102)


Web Application Common
1005933* - Identified Directory Traversal Sequence In Uri Query Parameter


Web Client Common
1009760* - Microsoft Windows Jet Database Engine Multiple Remote Code Execution Vulnerabilities (May-2019)
1010058 - Microsoft Windows Multiple Security Vulnerabilities (Nov 2019)
1010059 - Microsoft Windows Multiple Security Vulnerabilities (Nov 2019) - 1
1010057 - Microsoft Windows Win32k Graphics Remote Code Execution Vulnerability (CVE-2019-1441)


Web Server Common
1000763* - URI Length Restriction


Web Server Miscellaneous
1009804* - Eclipse Jetty HTTP2 SETTINGS Frames Resource Exhaustion Vulnerability (CVE-2018-12545)
1009942* - GNOME 'libsoup' HTTP Chunked Encoding Remote Code Execution Vulnerability (CVE-2017-2885)


Web Server Oracle
1009345* - Oracle WebLogic Server Java Deserialization Remote Code Execution Vulnerability
1009845* - Oracle Weblogic Server Remote Code Execution Vulnerability (CVE-2019-2650)


Windows SMB Server
1009910* - Identified Remote Service Creation Over DCE/RPC Protocol (Invoke-SMBexec Tool)


Integrity Monitoring Rules:

1003168* - Unix - Open Port Monitor


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.