Talos Rules 2024-12-19
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the file-flash, file-office, malware-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

29200

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29190

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29181

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29171

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29170

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29161

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29160

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29151

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29141

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29130

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

29111

2024-12-19 12:24:56 UTC

Snort Subscriber Rules Update

Date: 2024-12-19

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:64378 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64375 <-> ENABLED <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt (server-webapp.rules)
 * 1:64382 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64380 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt (server-webapp.rules)
 * 1:64377 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt (server-webapp.rules)
 * 1:64385 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt (malware-other.rules)
 * 1:64376 <-> ENABLED <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt (server-webapp.rules)
 * 1:64381 <-> DISABLED <-> FILE-OFFICE Microsoft Office font object type confusion attempt (file-office.rules)
 * 1:64374 <-> DISABLED <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt (policy-other.rules)
 * 1:64379 <-> DISABLED <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt (server-webapp.rules)
 * 3:64383 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)
 * 3:64384 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt (file-office.rules)

Modified Rules:


 * 1:41191 <-> DISABLED <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected (file-flash.rules)

3000

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3031

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3034

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3100

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3101

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3110

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3130

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3140

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3150

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3170

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3190

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

3200

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31110

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31150

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31180

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31200

2024-12-19 12:27:24 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31210

2024-12-19 12:27:25 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31350

2024-12-19 12:27:25 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31440

2024-12-19 12:27:25 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected

31470

2024-12-19 12:27:25 UTC

Snort Subscriber Rules Update

Date: 2024-12-18-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:301101 <-> SERVER-WEBAPP Fortinet FortiOS out of bounds write attempt
* 1:301102 <-> FILE-OFFICE Microsoft Office font object type confusion attempt
* 1:64374 <-> POLICY-OTHER WordPress Really Simple Security plugin potential authentication bypass attempt
* 1:64375 <-> SERVER-WEBAPP CyberPanel upgrademysqlstatus command injection attempt
* 1:64376 <-> SERVER-WEBAPP CyberPanel getresetstatus command injection attempt
* 1:64379 <-> SERVER-WEBAPP Cleo multiple products directory traversal attempt
* 1:64380 <-> SERVER-WEBAPP Cleo multiple products arbitrary file write attempt
* 3:64383 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 3:64384 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2024-2132 attack attempt
* 1:64385 <-> MALWARE-OTHER Unix.Trojan.Firewood download attempt

Modified Rules:

* 1:41191 <-> FILE-FLASH Adobe Flash SMTP MIME attachment detected