概要

* は既存ルールの新バージョンを示します。

DPI(Deep Packet Inspection) ルール:

DCERPCサービス
1010164* - Identified Possible Ransomware File Extension Create Activity Over Network Share
1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share


DCERPCサービス - クライアント
1007913* - Identified Possible Ransomware File Extension Rename Activity Over Network Share - Client


DNSサーバ
1010613 - Identified DNS Trojan.Win32.Trickbot.Dns Traffic


アプリケーションに関連する不審な活動（クライアント）
1010597* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (Office 365 Calendar Profile)
1010596* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (YouTube Profile)
1010617 - Identified TLS Cobalt Strike Beacon (Certificate)


アプリケーションに関連する不審な活動（サーバ）
1010616 - Identified HTTP Backdoor.Shell.Powertrick.A Runtime Detection
1010608 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Amazon Profile)
1010609 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Office 365 Calendar Profile)
1010614 - Identified HTTP Trickbot Data Exfiltration (Card Payment)
1010615 - Identified HTTP Trickbot Data Exfiltration (Network Module)
1010610 - Identified HTTP Trojan.Win64.BazarTrickbot Traffic
1010611 - Identified HTTP TrojanDownloader.Win64.BazarLoader Traffic
1010607 - Identified TCP Meterpreter Payload


Webアプリケーション 共通
1010592* - Zoho ManageEngine ServiceDesk Plus Cross Site Scripting Multiple Vulnerabilities


Webサーバ 共通
1010175* - Cross-Site Scripting (XSS) Decoder
1010562 - Mantis Bug Tracker 'verify.php' Remote Password Reset Vulnerability (CVE-2017-7615)


Webサーバ その他
1010480* - RichFaces Framework Expression Language Injection Vulnerability (CVE-2018-14667)
1010627 - Trend Micro InterScan Web Security Virtual Appliance Buffer Overflow Vulnerability (CVE-2020-28578)
1010626 - Trend Micro Interscan Web Security Virtual Appliance 'libuiauutil.so' Buffer Overflow Vulnerability (CVE-2020-28579)


Webサーバ Nagios
1010598 - Nagios XI 'admin_views.inc.php' Arbitrary File Overwrite Vulnerability


Webサーバ Oracle
1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882 and CVE-2020-14750)


変更監視（Integrity Monitoring）ルール:

1010055* - AntiVirus - Trend Micro ApexOne Server
1003744* - AntiVirus - Trend Micro OfficeScan Server


セキュリティログ監視（Log Inspection）ルール:

1010541* - Netlogon Elevation Of Privilege Vulnerability (Zerologon) (CVE-2020-1472)