Talos has added and modified multiple rules in the os-linux, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65022 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65016 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65019 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65017 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65023 <-> DISABLED <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt (policy-other.rules) * 1:65018 <-> ENABLED <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt (server-webapp.rules) * 1:65014 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65020 <-> DISABLED <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt (server-webapp.rules) * 1:65015 <-> DISABLED <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt (os-linux.rules) * 1:65021 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:65024 <-> ENABLED <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt (server-webapp.rules) * 3:65025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt (server-webapp.rules)
* 1:64842 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules) * 1:64841 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.7.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.9.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:301244 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301245 <-> OS-LINUX Linux Kernel Reliable Datagram Sockets escalation of privilege attempt * 1:301246 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301247 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:301248 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt * 1:65018 <-> SERVER-WEBAPP Fortra FileCatalyst SQL injection attempt * 1:65020 <-> SERVER-WEBAPP Apache HTTP Server local file inclusion attempt * 1:65023 <-> POLICY-OTHER lubusIN WP Query Console wordpress plugin command injection attempt * 1:65024 <-> SERVER-WEBAPP lubusIN WP Query Console wordpress plugin command injection attempt * 3:65025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2025-2193 attack attempt
* 1:301191 <-> OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt