20-058 (November 17, 2020)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1010164* - Identified Possible Ransomware File Extension Create Activity Over Network Share
1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share


DCERPC Services - Client
1007913* - Identified Possible Ransomware File Extension Rename Activity Over Network Share - Client


DNS Server
1010613 - Identified DNS Trojan.Win32.Trickbot.Dns Traffic


Suspicious Client Application Activity
1010597* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (Office 365 Calendar Profile)
1010596* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (YouTube Profile)
1010617 - Identified TLS Cobalt Strike Beacon (Certificate)


Suspicious Server Application Activity
1010616 - Identified HTTP Backdoor.Shell.Powertrick.A Runtime Detection
1010608 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Amazon Profile)
1010609 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Office 365 Calendar Profile)
1010614 - Identified HTTP Trickbot Data Exfiltration (Card Payment)
1010615 - Identified HTTP Trickbot Data Exfiltration (Network Module)
1010610 - Identified HTTP Trojan.Win64.BazarTrickbot Traffic
1010611 - Identified HTTP TrojanDownloader.Win64.BazarLoader Traffic
1010607 - Identified TCP Meterpreter Payload


Web Application Common
1010592* - Zoho ManageEngine ServiceDesk Plus Cross Site Scripting Multiple Vulnerabilities


Web Server Common
1010175* - Cross-Site Scripting (XSS) Decoder
1010562 - Mantis Bug Tracker 'verify.php' Remote Password Reset Vulnerability (CVE-2017-7615)


Web Server Miscellaneous
1010480* - RichFaces Framework Expression Language Injection Vulnerability (CVE-2018-14667)
1010627 - Trend Micro InterScan Web Security Virtual Appliance Buffer Overflow Vulnerability (CVE-2020-28578)
1010626 - Trend Micro Interscan Web Security Virtual Appliance 'libuiauutil.so' Buffer Overflow Vulnerability (CVE-2020-28579)


Web Server Nagios
1010598 - Nagios XI 'admin_views.inc.php' Arbitrary File Overwrite Vulnerability


Web Server Oracle
1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882 and CVE-2020-14750)


Integrity Monitoring Rules:

1010055* - AntiVirus - Trend Micro ApexOne Server
1003744* - AntiVirus - Trend Micro OfficeScan Server


Log Inspection Rules:

1010541* - Netlogon Elevation Of Privilege Vulnerability (Zerologon) (CVE-2020-1472)