All Vulnerabilities
- * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services - Client
1007120* - SMB DLL Injection Exploit Detected (ATT&CK T1055.001)
Microsoft Office
1011095 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501)
NFS Server
1011079* - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)
OpenSSL Client
1006017* - Restrict OpenSSL TLS/DTLS Heartbeat Message (ATT&CK T1573.002)
Port Mapper FTP Client
1009558* - Remote File Copy Over FTP (ATT&CK T1544, T1071.002)
SAP NetWeaver Java Application Server
1010822* - Identified SAP Solution Manager Tool Transfer Over HTTP (ATT&CK T1105)
SSL Client
1009915* - Identified WhatsApp Registration (ATT&CK T1102.002)
1009932* - Telegram Bot API Usage (Used by Telecrypt) (ATT&CK T1102.002)
SSL Client Applications
1009914* - Identified Github Authentication (ATT&CK T1102.002)
1001113* - SSL/TLS Client (ATT&CK T1573.002)
Suspicious Client Application Activity
1005283* - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1571)
1005300* - Identified Potentially Malicious RAT Traffic - IV (ATT&CK T1571)
1005473* - Identified Potentially Malicious RAT Traffic - V (ATT&CK T1571)
1006247* - Identified Potentially Malicious RAT Traffic - VI (ATT&CK T1571)
1008756* - Identified Potentially Malicious RAT Traffic - VII (ATT&CK T1571)
Web Application Common
1007170* - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1505.003)
1009911* - Identified Twitter Command & Control Communication (ATT&CK T1102.002)
Web Application PHP Based
1011074* - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)
Web Client Common
1000943* - Detect UPX Packed Executable Download (ATT&CK T1027.002)
1009912* - Detected Vkontakte Site Access Over HTTP (ATT&CK T1102.002)
Web Client SSL
1006296* - Detected SSLv3 Response (ATT&CK T1573.002)
1006298* - Identified CBC Based Cipher Suite In SSLv3 Request (ATT&CK T1573.002)
Web Server Common
1005434* - Disallow Upload Of A PHP File (ATT&CK T1190)
1005013* - Restrict Microsoft .Net Executable File Upload (ATT&CK T1190)
1003025* - Web Server Restrict Executable File Uploads (ATT&CK T1190)
Web Server HTTPS
1011088 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011060* - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)
Web Server Miscellaneous
1011044* - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
1011061 - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011093 - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server SharePoint
1010836* - Identified Microsoft SharePoint GetGroupCollection Request (ATT&CK T1213.002)
1010835* - Identified Microsoft SharePoint GetGroupCollectionFromRole Request (ATT&CK T1213.002, T1087)
1010834* - Identified Microsoft SharePoint GetGroupCollectionFromSite Request (ATT&CK T1213.002)
1010833* - Identified Microsoft SharePoint GetGroupCollectionFromUser Request (ATT&CK T1213.002, T1087)
1010832* - Identified Microsoft SharePoint GetGroupCollectionFromWeb Request (ATT&CK T1213.002)
1010831* - Identified Microsoft SharePoint GetGroupInfo Request (ATT&CK T1213.002)
1010823* - Identified Microsoft SharePoint GetPermissionCollection Request (ATT&CK T1069, T1213.002, T1589.002)
1010830* - Identified Microsoft SharePoint GetRoleCollection Request (ATT&CK T1213.002)
1010747* - Identified Microsoft SharePoint GetRolesAndPermissionsForSite Request (ATT&CK T1589.003)
1010746* - Identified Microsoft SharePoint GetUserInfo Request (ATT&CK T1589.003)
Windows Services RPC Server DCERPC
1009478* - Identified Remote Service Creation Over DCE/RPC Protocol (ATT&CK T1543.003)
1007054* - Remote Schedule Task 'Create' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
1007053* - Remote Schedule Task 'Delete' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
1007017* - Remote Schedule Task 'Run' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
Zabbix Server
1011073* - Zabbix Server Multiple Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
1003354* - Linux/Unix - Configuration files of sendmail utility modified
1003168* - Linux/Unix - Listening ports modified
1003169* - Linux/Unix - Process attributes modified
1009745* - Linux/Unix - Removable Device Detected (ATT&CK T1092)
1010422* - Linux/Unix - SCP process detected (ATT&CK T1105, T1048.001)
1010791* - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009704* - Microsoft Windows - Boot or Logon Autostart Execution: Port Monitors (ATT&CK T1547.010)
Log Inspection Rules:
1002797* - Database Server - MySQL
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1008670* - Microsoft Windows Security Events - 3 - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
File Sharing Applications
1003651* - Windows Live FolderShare (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1003243* - Yahoo Instant Message URL Blocker (ATT&CK T1102.002)
1002163* - Yahoo! Messenger (ATT&CK T1102.002)
1002384* - Yahoo! Messenger File Transfers (ATT&CK T1102.002)
NFS Server
1011079 - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)
OpenSSL
1006307* - Detected Too Many Suspicious TLS/SSL Client Hello Messages (ATT&CK T1573.002)
1006012* - Identified Suspicious OpenSSL TLS/DTLS Heartbeat Request (ATT&CK T1573.002)
1005474* - Identified Weak Cipher Support From TLS/SSL Server (ATT&CK T1573.002)
OpenSSL Client
1006184* - Identified OpenSSL DTLS Anonymous ECDH Cipher Suite (ATT&CK T1573.002)
1006190* - Identified OpenSSL SRP Cipher Suite In Server Hello Message (ATT&CK T1573.002)
Port Mapper FTP Client
1011089 - Identified File Upload Over FTP (ATT&CK T1048.003)
Remote Desktop Protocol Server
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001, T1573.002)
Remote Login Applications
1002487* - SSH Client (ATT&CK T1021.004)
SSL Client
1006740* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Client (ATT&CK T1573.002)
SSL/TLS Server
1006026* - Identified Compression Algorithm In SSL/TLS (ATT&CK T1573.002)
Suspicious Client Application Activity
1007197* - TMTR-0005: GHOST RAT TCP Connection Detected (ATT&CK T1571)
1007200* - TMTR-0010: FAKEM RAT TCP Connection (ATT&CK T1571)
1007201* - TMTR-0011: FAKEM RAT TCP Request (ATT&CK T1571)
1007205* - TMTR-0012: FAKEM RAT TCP Connection (ATT&CK T1571)
1007207* - TMTR-0014: NJRAT TCP Connection (ATT&CK T1571)
1007208* - TMTR-0016: SPLINTER RAT TCP Connection (ATT&CK T1571)
1007209* - TMTR-0017: ZIYAZO RAT BKDR Connection (ATT&CK T1571)
Trend Micro OfficeScan
1011057* - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1005427* - Identified Suspicious Upload Of Archive File (ATT&CK T1190)
1010122* - WordPress Plainview Activity Monitor Plugin Remote Code Execution Vulnerability (CVE-2018-15877)
Web Application PHP Based
1011074 - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)
Web Client Common
1011090 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21148)
1011075 - Google Chrome Type Confusion Vulnerability (CVE-2019-13764)
1005269* - Identified Download Of DLL File Over WebDAV (ATT&CK T1574.002)
1011091 - Identified Download Of Executable File Over HTTP (ATT&CK T1105)
1003244* - Identified Suspicious Obfuscated JavaScript (ATT&CK T1203, T1001)
1006391* - Identified Suspicious Obfuscated JavaScript - 1 (ATT&CK T1203, T1001)
1006599* - Identified Suspicious Obfuscated JavaScript - 3 (ATT&CK T1203, T1001)
1006882* - Identified Suspicious Obfuscated JavaScript - 4 (ATT&CK T1203, T1001)
1008185* - Identified Suspicious Obfuscated PDF Document (ATT&CK T1027, T1204.002)
1008297* - Identified Suspicious RTF File With Obfuscated PowerShell Execution (ATT&CK T1027, T1204.002, T1059.001)
Web Client Internet Explorer/Edge
1011077 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34480)
Web Client SSL
1006024* - Identified Compression Algorithm In SSL/TLS Message (ATT&CK T1573.002)
1005040* - Identified Revoked Certificate Authority In SSL Traffic (ATT&CK T1573.002)
Web Server Common
1008621* - Disallow Upload Of A JSP File (ATT&CK T1190)
1010405* - JAWS Remote Code Execution Vulnerability
Web Server HTTPS
1008137* - Identified TLS/SSL DES Cipher Suite Is Being Supported (ATT&CK T1573.002)
1005641* - Identified TLS/SSL RC4 Cipher Suite Is Being Supported (ATT&CK T1573.002)
1006064* - Identified Too Many Compressed HTTP Responses (ATT&CK T1071.001)
1007491* - Identified Usage Of EXPORT Cipher Suite In SSLv2 Connection (ATT&CK T1573.002)
1006562* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Request (ATT&CK T1573.002)
1011072* - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011060 - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)
1011046* - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server Miscellaneous
1011044 - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Windows SMB Server
1011058* - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol (PetitPotam)
Zabbix Server
1011073 - Zabbix Server Multiple Remote Code Execution Vulnerabilities
Zoho ManageEngine
1011062* - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064* - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1011059 - Microsoft Windows - Security support providers (SSP) registry key modified (ATT&CK T1547.005)
Log Inspection Rules:
1003802* - Directory Server - Microsoft Windows Active Directory
1010002* - Microsoft PowerShell Command Execution - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)
DNS Client
1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
1007605* - BOX (ATT&CK T1102.002, T1567.002)
1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1002103* - AOL Instant Messenger (ATT&CK T1102.002)
1004663* - IP Messenger (ATT&CK T1102.002)
1002507* - Jabber (ATT&CK T1102.002)
1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
1002162* - MSN Messenger (ATT&CK T1102.002)
1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
1004941* - QQ Messenger (ATT&CK T1102.002)
Mail Client Applications
1001112* - SMTP Client (ATT&CK T1071.003)
Remote Login Applications
1002508* - RDP (ATT&CK T1021.001)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)
SSL/TLS Server
1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)
Suspicious Client Application Activity
1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)
Suspicious Server Application Activity
1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)
Trend Micro OfficeScan
1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Application PHP Based
1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
1004302* - Microsoft Windows Shortcut Remote Code Execution
Web Server Common
1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)
Web Server HTTPS
1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server SharePoint
1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
Zoho ManageEngine
1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)
DCERPC Services - Client
1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)
Directory Server LDAP
1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)
Remote Desktop Protocol Server
1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)
Suspicious Server Application Activity
1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)
Unix SSH
1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)
Web Client SharePoint
1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)
Web Media Applications
1009913* - Identified Pastebin Communication (ATT&CK T1102.002)
Web Server Common
1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)
Web Server HTTPS
1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
Web Server Nagios
1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)
Windows Remote Management
1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)
Windows Remote Management Client
1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)
Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)
Integrity Monitoring Rules:
1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
1003573* - Linux/Unix - File attributes in the /bin directory modified
1003513* - Linux/Unix - File attributes in the /etc directory modified
1003514* - Linux/Unix - File attributes in the /lib directory modified
1003574* - Linux/Unix - File attributes in the /sbin directory modified
1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Pulsar Binary Protocol
1010998* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)
Web Application Common
1011047 - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011043 - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
Web Client Common
1011048 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21166)
1011049 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)
Web Client Internet Explorer/Edge
1010133* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674)
Web Server HTTPS
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011035 - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
1011028* - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)
Web Server Nagios
1011023* - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
1011022 - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011030* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Oracle E-Business Suite Web Interface
1011019* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)
Pulsar Binary Protocol
1010998 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)
Web Client Common
1011032 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
Web Client Internet Explorer/Edge
1011040 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34448)
Web Server Common
1009705* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2019-3396)
Web Server HTTPS
1011041 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011028 - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)
Web Server Nagios
1011023 - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
Web Server SharePoint
1011030 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)
Windows Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Zoho ManageEngine
1011020* - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
Integrity Monitoring Rules:
1002875* - Linux/Unix - Software installed, updated or removed
1010373* - Linux/Unix - Systemd service modified (ATT&CK T1543.002)
1010791 - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
1009622* - Linux/Unix - bash non-root user configuration files modified (ATT&CK T1546.004)
1011021 - Linux/Unix - bash root user configuration files modified (ATT&CK T1546.004)
Log Inspection Rules:
1011042 - SolarWinds Serv-U SSH EXCEPTION (CVE-2021-35211) - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
Directory Server LDAP
1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Oracle E-Business Suite Web Interface
1010999* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
1011019 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)
Port Mapper Windows
1001033* - Windows Port Mapper Decoder
Web Application Common
1005934* - Identified Suspicious Command Injection Attack
Web Application PHP Based
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Server Apache
1010997* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)
Web Server HTTPS
1011015* - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability
Windows SMB Server
1011018* - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol
Windows Services RPC Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol
Zoho ManageEngine
1011020 - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
1011012* - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DNS Server
1010986* - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)
Directory Server LDAP
1011008 - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Oracle E-Business Suite Web Interface
1010999 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
Web Application PHP Based
1011013 - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010711* - Google Chrome Buffer Overflow Vulnerability (CVE-2019-5782)
1011007 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-695)
1011006 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-697)
1011005 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-699)
1011004 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-701)
1011002 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-703)
1011001 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-704)
1011000 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-705)
1011003 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-21-702)
1011011 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-696)
1011010 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-698)
1011009 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-700)
Web Server Apache
1010997 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)
Web Server Common
1010980* - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
1010985* - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)
Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
1011015 - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability
Zoho ManageEngine
1011012 - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability
Integrity Monitoring Rules:
1010843 - Linux/Unix - Boot files modified (ATT&CK T1542)
1010845 - Linux/Unix - Default firewall rules modified (ATT&CK T1562.004)
1010846 - Linux/Unix - Disk configuration files modified (ATT&CK T1561.002)
1010847 - Linux/Unix - SSL configuration files modified (ATT&CK T1587.003)
1010793 - Linux/Unix - Shared object files modified
1010856 - Linux/Unix - Static boot loader files modified (ATT&CK T1542)
1010848 - Linux/Unix - User access control files modified (ATT&CK T1068)
1010844 - Linux/Unix - modeprobe configuration files modified (ATT&CK T1547.006)
Log Inspection Rules:
1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001) - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DNS Server
1010986 - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)
Microsoft Office
1010991 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-31939)
1010992 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-31941)
Web Application PHP Based
1010993 - WordPress 'Directories Pro' Plugin Cross-Site Scripting Vulnerability (CVE-2020-29304)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010974* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-37)
1010978* - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010995 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31945)
1010994 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31946)
1010996 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31983)
1010987 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-27068)
Web Server Common
1010985 - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)
Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Web Server Oracle
1005128* - Oracle Business Transaction Management Server 'FlashTunnelService' WriteToFile Message Remote Code Execution
Web Server SharePoint
1010947* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-31181)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update. - * indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1010900* - Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2021-28325)
SolarWinds Orion NPM
1010975 - SolarWinds Orion Job Scheduler Remote Code Execution Vulnerability (CVE-2021-31475)
Web Application PHP Based
1010982 - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)
Web Client Common
1010978 - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010984 - Microsoft Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2021-33739)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server Common
1010980 - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
Web Server HTTPS
1010983 - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1010976 - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Integrity Monitoring Rules:
1010821 - Linux/Unix - Alternative commands modified (ATT&CK T1036)
1010842 - Linux/Unix - Boot loader configuration files modified (ATT&CK T1542)
1010838 - Linux/Unix - Core system configuration files modified
1010979 - Linux/Unix - FTP client process initiated (ATT&CK T1048)
1010840 - Linux/Unix - Host access control files modified (ATT&CK T1584.004)
1010964 - Linux/Unix - Internet routing information file modified
1010963 - Linux/Unix - Kernel configuration files modified (ATT&CK T1547.006)
1010809 - Linux/Unix - List of valid login shells modified (ATT&CK T1059.004)
1010798 - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
1010839 - Linux/Unix - Name of the local system modified (ATT&CK T1082)
1010812 - Linux/Unix - Name resolver configuration files modified (ATT&CK T1071.004, T1583.002)
1010962 - Linux/Unix - Network services configuration files modified
1010813 - Linux/Unix - PAM configuration files modified (ATT&CK T1068)
1010853 - Linux/Unix - Process initialization scripts and configuration files modified (ATT&CK 1037)
1010817 - Linux/Unix - Run control (rc) scripts modified (ATT&CK T1037.004)
1010815 - Linux/Unix - Samba configuration files modified (ATT&CK T1135)
1010824 - Linux/Unix - Software repository modified (ATT&CK T1195.002)
1010807 - Linux/Unix - System wide environment variables and startup scripts modified (ATT&CK T1546.004)
1010825 - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
1010808 - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
1010827 - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
1010826 - Linux/Unix - dhclient configuration files modified
1010841 - Linux/Unix - ftpd configuration files modified (ATT&CK T1048, T1071.002)
1010805 - Linux/Unix - runtime linker configuration files modified
1010950 - Linux/Unix - sudo files modified (ATT&CK T1548.003)
1010819 - Linux/Unix - xinetd configuration files modified
1010828 - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.