Rule Update
DPIルール他更新情報：21-016（2021年4月6日）
概要
* は既存ルールの新バージョンを示します。
DPI(Deep Packet Inspection) ルール:
DNSクライアント
1010784* - DNSmasq DNSSEC Out Of Bounds Write Vulnerability (CVE-2020-25687)
DNSサーバ
1010613* - Identified DNS Trojan.Win32.Trickbot.Dns Traffic
アプリケーションに関連する不審な活動（クライアント）
1010741* - Identified HTTP Backdoor Python FreakOut A Runtime Detection
ランサムウェアに関連する不審な活動（クライアント）
1010792* - Identified Cobalt Strike Default Self-signed SSL/TLS Certificate
1010597* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (Office 365 Calendar Profile)
1010596* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (YouTube Profile)
1010714* - Identified HTTP Trojan-Downloader.Win32.Cometer.bfc C&C Traffic Request
1010617* - Identified TLS Cobalt Strike Beacon (Certificate)
ランサムウェアに関連する不審な活動（サーバ）
1010638* - Identified FTP Backdoor.Win32.Qbot.JINX Runtime Detection
1010616* - Identified HTTP Backdoor.Shell.Powertrick.A Runtime Detection
1010608* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Amazon Profile)
1010637* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Google Safe Browsing Profile)
1010609* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Office 365 Calendar Profile)
1010636* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Pandora GET Profile)
1010639* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Pandora POST Profile)
1010731* - Identified HTTP Redhat Webshell C&C Traffic
1010614* - Identified HTTP Trickbot Data Exfiltration (Card Payment)
1010615* - Identified HTTP Trickbot Data Exfiltration (Network Module)
1010634* - Identified HTTP Trickbot Data Exfiltration - (Application Credentials Grabber)
1010644* - Identified HTTP Trojan-Downloader.Shell.Lightbot.A C&C Traffic Request
1010610* - Identified HTTP Trojan.Win64.BazarTrickbot Traffic
1010611* - Identified HTTP TrojanDownloader.Win64.BazarLoader Traffic
1010607* - Identified TCP Meterpreter Payload
Webアプリケーション PHP
1010886 - Batflat CMS Remote Code Execution Vulnerability (CVE-2020-35734)
Webクライアント 共通
1010806 - Identified Directory Traversal Attack In HTTP Response Headers
Webサーバ 共通
1010867* - Apache ActiveMQ Web Console Reflected Cross-Site Scripting Vulnerability (CVE-2020-13947)
1010871 - Cisco Data Center Network Manager Arbitrary File Upload Vulnerability (CVE-2019-1620)
1010734* - Identified BumbleBee Webshell Traffic Over HTTP
1010814 - Identified SAP Solution Manager Removal On Host Attempt (ATT&CK T1070.004)
Webサーバ HTTPS
1010868* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065)
1010870* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) - 1
1010875* - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability (CVE-2020-12255)
Webサーバ Oracle
1010887 - Identify Oracle Application Server Config Files Access
Windows SMBサーバ
1010884* - Microsoft Windows RPC Remote Code Execution Vulnerability (CVE-2017-8461)
変更監視（Integrity Monitoring）ルール:
今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。
セキュリティログ監視（Log Inspection）ルール:
今回のセキュリティアップデートには、新規のセキュリティログ監視ルールおよび更新は含まれておりません。
DPI(Deep Packet Inspection) ルール:
DNSクライアント
1010784* - DNSmasq DNSSEC Out Of Bounds Write Vulnerability (CVE-2020-25687)
DNSサーバ
1010613* - Identified DNS Trojan.Win32.Trickbot.Dns Traffic
アプリケーションに関連する不審な活動（クライアント）
1010741* - Identified HTTP Backdoor Python FreakOut A Runtime Detection
ランサムウェアに関連する不審な活動（クライアント）
1010792* - Identified Cobalt Strike Default Self-signed SSL/TLS Certificate
1010597* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (Office 365 Calendar Profile)
1010596* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (YouTube Profile)
1010714* - Identified HTTP Trojan-Downloader.Win32.Cometer.bfc C&C Traffic Request
1010617* - Identified TLS Cobalt Strike Beacon (Certificate)
ランサムウェアに関連する不審な活動（サーバ）
1010638* - Identified FTP Backdoor.Win32.Qbot.JINX Runtime Detection
1010616* - Identified HTTP Backdoor.Shell.Powertrick.A Runtime Detection
1010608* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Amazon Profile)
1010637* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Google Safe Browsing Profile)
1010609* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Office 365 Calendar Profile)
1010636* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Pandora GET Profile)
1010639* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Pandora POST Profile)
1010731* - Identified HTTP Redhat Webshell C&C Traffic
1010614* - Identified HTTP Trickbot Data Exfiltration (Card Payment)
1010615* - Identified HTTP Trickbot Data Exfiltration (Network Module)
1010634* - Identified HTTP Trickbot Data Exfiltration - (Application Credentials Grabber)
1010644* - Identified HTTP Trojan-Downloader.Shell.Lightbot.A C&C Traffic Request
1010610* - Identified HTTP Trojan.Win64.BazarTrickbot Traffic
1010611* - Identified HTTP TrojanDownloader.Win64.BazarLoader Traffic
1010607* - Identified TCP Meterpreter Payload
Webアプリケーション PHP
1010886 - Batflat CMS Remote Code Execution Vulnerability (CVE-2020-35734)
Webクライアント 共通
1010806 - Identified Directory Traversal Attack In HTTP Response Headers
Webサーバ 共通
1010867* - Apache ActiveMQ Web Console Reflected Cross-Site Scripting Vulnerability (CVE-2020-13947)
1010871 - Cisco Data Center Network Manager Arbitrary File Upload Vulnerability (CVE-2019-1620)
1010734* - Identified BumbleBee Webshell Traffic Over HTTP
1010814 - Identified SAP Solution Manager Removal On Host Attempt (ATT&CK T1070.004)
Webサーバ HTTPS
1010868* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065)
1010870* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) - 1
1010875* - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability (CVE-2020-12255)
Webサーバ Oracle
1010887 - Identify Oracle Application Server Config Files Access
Windows SMBサーバ
1010884* - Microsoft Windows RPC Remote Code Execution Vulnerability (CVE-2017-8461)
変更監視（Integrity Monitoring）ルール:
今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。
セキュリティログ監視（Log Inspection）ルール:
今回のセキュリティアップデートには、新規のセキュリティログ監視ルールおよび更新は含まれておりません。