Rule Update
21-038 (August 24, 2021)
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1011105 - Identified File Deletion From SMB Share (ATT&CK T1070.004)
1011104 - Identified Network Share Discovery (ATT&CK T1135)
Java RMI
1011078 - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)
Web Application Common
1010668* - FUEL CMS Remote Code Execution Vulnerability (CVE-2018-16763)
1011094 - Identified User Creation Attempt In GitStack
Web Server HTTPS
1011088* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011100 - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011061* - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011099 - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
1011093* - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server Oracle
1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882, CVE-2020-14750 and CVE-2020-14883)
1011096 - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Windows SMB Client
1011055 - Identified DCERPC OpenPrinterEx Call Over SMB Protocol
Integrity Monitoring Rules:
1003533* - Application - OpenSSH (ATT&CK T1021.004)
1011067 - Linux/Unix - Permissions on ssh private host keys modified (ATT&CK T1021.004, T1222.002)
1011070 - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
1011068 - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1563.001, T1021.004, T1098.004)
1011069 - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1563.001, T1021.004, T1098.004)
1011066 - Linux/Unix - SSH client configuration modified (ATT&CK1021.004)
1011063 - Linux/Unix - SSH server configuration file modified (ATT&CK T1021.004)
1011071 - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1011092 - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
Log Inspection Rules:
1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Deep Packet Inspection Rules:
DCERPC Services
1011105 - Identified File Deletion From SMB Share (ATT&CK T1070.004)
1011104 - Identified Network Share Discovery (ATT&CK T1135)
Java RMI
1011078 - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)
Web Application Common
1010668* - FUEL CMS Remote Code Execution Vulnerability (CVE-2018-16763)
1011094 - Identified User Creation Attempt In GitStack
Web Server HTTPS
1011088* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011100 - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011061* - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011099 - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
1011093* - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server Oracle
1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882, CVE-2020-14750 and CVE-2020-14883)
1011096 - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Windows SMB Client
1011055 - Identified DCERPC OpenPrinterEx Call Over SMB Protocol
Integrity Monitoring Rules:
1003533* - Application - OpenSSH (ATT&CK T1021.004)
1011067 - Linux/Unix - Permissions on ssh private host keys modified (ATT&CK T1021.004, T1222.002)
1011070 - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
1011068 - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1563.001, T1021.004, T1098.004)
1011069 - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1563.001, T1021.004, T1098.004)
1011066 - Linux/Unix - SSH client configuration modified (ATT&CK1021.004)
1011063 - Linux/Unix - SSH server configuration file modified (ATT&CK T1021.004)
1011071 - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1011092 - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
Log Inspection Rules:
1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)