Talos Rules 2019-05-20
This release adds and modifies rules in several categories.

This release contains an updated HTTP configuration within the Balanced Connectivity and Security policy for all supported product versions. This change enables gzip decompression of HTTP transport data and the inspection of the contents contained therein. This change brings the policy in line with intended use as over 75% of today’s Web traffic is compressed during transport (https://w3techs.com/technologies/details/ce-compression/all/all) and that percentage increases daily as providers deal with the ever-increasing number of users and demands of Web traffic on mobile networks. When gzip decompression was added to the Security Over Connectivity and Maximum Detection policies, the addition wasn’t made to Balanced because the amount of gzip data was relatively low and it was deemed the processing overhead required to decompress the data was not in line with the stated performance goals of the policy. But with today’s world both in terms of the amount compression in use and in the processing power available to handle the decompression, it makes sense for it to be enabled.

Talos has added and modified multiple rules in the deleted, file-flash, file-other, file-pdf, malware-cnc, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2990

2019-05-29 18:23:30 UTC

Snort Subscriber Rules Update

Date: 2019-05-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2990.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50144 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50139 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50143 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50138 <-> ENABLED <-> MALWARE-CNC Win.Dropper.ELECTRICFISH variant outbound connection (malware-cnc.rules)
 * 1:50146 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50153 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50152 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50137 <-> ENABLED <-> OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt (os-windows.rules)
 * 1:50147 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50140 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50148 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50150 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50142 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50151 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50149 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50141 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50145 <-> DISABLED <-> SERVER-WEBAPP CAS Server LDAP authentication bypass attempt (server-webapp.rules)
 * 1:50126 <-> DISABLED <-> DELETED BsjDI047fZX0z0iY13tV (deleted.rules)
 * 3:50135 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50134 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50136 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)

Modified Rules:


 * 1:50003 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Message Server RFC server registration attempt (server-other.rules)
 * 1:50121 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:50001 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50002 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:49981 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50122 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49980 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:49355 <-> ENABLED <-> MALWARE-CNC Win.Trojan.KerrDown variant outbound connection (malware-cnc.rules)

2983

2019-05-29 18:23:30 UTC

Snort Subscriber Rules Update

Date: 2019-05-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50137 <-> ENABLED <-> OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt (os-windows.rules)
 * 1:50146 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50140 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50145 <-> DISABLED <-> SERVER-WEBAPP CAS Server LDAP authentication bypass attempt (server-webapp.rules)
 * 1:50153 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50142 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50149 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50150 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50152 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50148 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50147 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50151 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50138 <-> ENABLED <-> MALWARE-CNC Win.Dropper.ELECTRICFISH variant outbound connection (malware-cnc.rules)
 * 1:50144 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50126 <-> DISABLED <-> DELETED BsjDI047fZX0z0iY13tV (deleted.rules)
 * 1:50141 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50143 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50139 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 3:50136 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50134 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50135 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)

Modified Rules:


 * 1:49981 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50001 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50003 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Message Server RFC server registration attempt (server-other.rules)
 * 1:50122 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:50002 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50121 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49980 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:49355 <-> ENABLED <-> MALWARE-CNC Win.Trojan.KerrDown variant outbound connection (malware-cnc.rules)

3000

2019-05-29 18:23:30 UTC

Snort Subscriber Rules Update

Date: 2019-05-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50149 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (snort3-server-webapp.rules)
 * 1:50148 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (snort3-server-webapp.rules)
 * 1:50140 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (snort3-file-flash.rules)
 * 1:50138 <-> ENABLED <-> MALWARE-CNC Win.Dropper.ELECTRICFISH variant outbound connection (snort3-malware-cnc.rules)
 * 1:50141 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (snort3-file-other.rules)
 * 1:50142 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (snort3-file-other.rules)
 * 1:50146 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (snort3-malware-cnc.rules)
 * 1:50137 <-> ENABLED <-> OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt (snort3-os-windows.rules)
 * 1:50139 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (snort3-file-flash.rules)
 * 1:50144 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (snort3-file-pdf.rules)
 * 1:50147 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (snort3-malware-cnc.rules)
 * 1:50126 <-> DISABLED <-> DELETED BsjDI047fZX0z0iY13tV (snort3-deleted.rules)
 * 1:50150 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (snort3-file-pdf.rules)
 * 1:50151 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (snort3-file-pdf.rules)
 * 1:50143 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (snort3-file-pdf.rules)
 * 1:50153 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (snort3-file-pdf.rules)
 * 1:50145 <-> DISABLED <-> SERVER-WEBAPP CAS Server LDAP authentication bypass attempt (snort3-server-webapp.rules)
 * 1:50152 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (snort3-file-pdf.rules)

Modified Rules:


 * 1:50121 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (snort3-os-windows.rules)
 * 1:50002 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (snort3-server-other.rules)
 * 1:50122 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (snort3-os-windows.rules)
 * 1:50003 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Message Server RFC server registration attempt (snort3-server-other.rules)
 * 1:50001 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (snort3-server-other.rules)
 * 1:49980 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (snort3-server-other.rules)
 * 1:49981 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (snort3-server-other.rules)
 * 1:49355 <-> ENABLED <-> MALWARE-CNC Win.Trojan.KerrDown variant outbound connection (snort3-malware-cnc.rules)

29111

2019-05-29 18:23:30 UTC

Snort Subscriber Rules Update

Date: 2019-05-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50140 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50141 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50126 <-> DISABLED <-> DELETED BsjDI047fZX0z0iY13tV (deleted.rules)
 * 1:50142 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50145 <-> DISABLED <-> SERVER-WEBAPP CAS Server LDAP authentication bypass attempt (server-webapp.rules)
 * 1:50139 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50143 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50147 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50149 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50148 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50153 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50151 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50152 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50144 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50150 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50146 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50138 <-> ENABLED <-> MALWARE-CNC Win.Dropper.ELECTRICFISH variant outbound connection (malware-cnc.rules)
 * 1:50137 <-> ENABLED <-> OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt (os-windows.rules)
 * 3:50136 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50135 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50134 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)

Modified Rules:


 * 1:50001 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50122 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49980 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50003 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Message Server RFC server registration attempt (server-other.rules)
 * 1:49355 <-> ENABLED <-> MALWARE-CNC Win.Trojan.KerrDown variant outbound connection (malware-cnc.rules)
 * 1:50121 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49981 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50002 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)

29120

2019-05-29 18:23:30 UTC

Snort Subscriber Rules Update

Date: 2019-05-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091200.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50153 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50139 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50140 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50141 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50146 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50148 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50138 <-> ENABLED <-> MALWARE-CNC Win.Dropper.ELECTRICFISH variant outbound connection (malware-cnc.rules)
 * 1:50149 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50144 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50147 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50152 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50150 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50151 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50142 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50143 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50145 <-> DISABLED <-> SERVER-WEBAPP CAS Server LDAP authentication bypass attempt (server-webapp.rules)
 * 1:50126 <-> DISABLED <-> DELETED BsjDI047fZX0z0iY13tV (deleted.rules)
 * 1:50137 <-> ENABLED <-> OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt (os-windows.rules)
 * 3:50134 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50135 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50136 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)

Modified Rules:


 * 1:50001 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50002 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50121 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49981 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50122 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49980 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50003 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Message Server RFC server registration attempt (server-other.rules)
 * 1:49355 <-> ENABLED <-> MALWARE-CNC Win.Trojan.KerrDown variant outbound connection (malware-cnc.rules)

29130

2019-05-29 18:23:30 UTC

Snort Subscriber Rules Update

Date: 2019-05-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50150 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 1:50149 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50148 <-> DISABLED <-> SERVER-WEBAPP SirsiDynix e-Library cross site scripting attempt (server-webapp.rules)
 * 1:50147 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50146 <-> ENABLED <-> MALWARE-CNC Linux.Trojan.ChachaDDoS outbound connection (malware-cnc.rules)
 * 1:50145 <-> DISABLED <-> SERVER-WEBAPP CAS Server LDAP authentication bypass attempt (server-webapp.rules)
 * 1:50144 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50143 <-> ENABLED <-> FILE-PDF Adobe Acrobat out-of-bounds write attempt (file-pdf.rules)
 * 1:50142 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50141 <-> ENABLED <-> FILE-OTHER Adobe Acrobat type confusion attempt (file-other.rules)
 * 1:50140 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50139 <-> ENABLED <-> FILE-FLASH Adobe Flash Player out-of-bounds read attempt (file-flash.rules)
 * 1:50138 <-> ENABLED <-> MALWARE-CNC Win.Dropper.ELECTRICFISH variant outbound connection (malware-cnc.rules)
 * 1:50137 <-> ENABLED <-> OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt (os-windows.rules)
 * 1:50126 <-> DISABLED <-> DELETED BsjDI047fZX0z0iY13tV (deleted.rules)
 * 1:50153 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50152 <-> ENABLED <-> FILE-PDF Adobe Acrobat integer overflow attempt (file-pdf.rules)
 * 1:50151 <-> ENABLED <-> FILE-PDF Adobe Acrobat use after free attempt (file-pdf.rules)
 * 3:50134 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50135 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)
 * 3:50136 <-> ENABLED <-> SERVER-WEBAPP Cisco Video Surveillance Manager directory traversal attempt (server-webapp.rules)

Modified Rules:


 * 1:50002 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:50121 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:50001 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary command execution attempt (server-other.rules)
 * 1:49981 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50122 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TrueType font parsing integer underflow attempt (os-windows.rules)
 * 1:49980 <-> ENABLED <-> SERVER-OTHER SAP NetWeaver Gateway arbitrary code execution attempt (server-other.rules)
 * 1:50003 <-> DISABLED <-> SERVER-OTHER SAP NetWeaver Message Server RFC server registration attempt (server-other.rules)
 * 1:49355 <-> ENABLED <-> MALWARE-CNC Win.Trojan.KerrDown variant outbound connection (malware-cnc.rules)