©2025 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
Microsoft Vulnerability CVE-2025-32713: A coding deficiency exists in Microsoft Windows Common Log File System Driver that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65038, 1:65039, Snort 3: GID 1, SID 1:301253.
Microsoft Vulnerability CVE-2025-32714: A coding deficiency exists in Microsoft Windows Installer that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65040, 1:65041, Snort 3: GID 1, SID 1:301254.
Microsoft Vulnerability CVE-2025-33053: A coding deficiency exists in Microsoft Web Distributed Authoring and Versioning (WEBDAV) that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65042, 1:65043, Snort 3: GID 1, SID 1:301255.
Microsoft Vulnerability CVE-2025-33070: A coding deficiency exists in Microsoft Windows Netlogon that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:55802, 1:56290, 1:65030, Snort 3: GID 1, SID 1:301220, 1:55802, 1:56290.
Microsoft Vulnerability CVE-2025-33071: A coding deficiency exists in Microsoft Windows KDC Proxy Service (KPSSVC) that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65037, Snort 3: GID 1, SID 1:65037.
Microsoft Vulnerability CVE-2025-47162: A coding deficiency exists in Microsoft Office that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65031, 1:65032, Snort 3: GID 1, SID 1:301250.
Microsoft Vulnerability CVE-2025-47164: A coding deficiency exists in Microsoft Office that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65033, 1:65034, Snort 3: GID 1, SID 1:301251.
Microsoft Vulnerability CVE-2025-47167: A coding deficiency exists in Microsoft Office that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SID 1:65035, 1:65036, Snort 3: GID 1, SID 1:301252.
Talos has added and modified multiple rules in the deleted, file-office and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules)
* 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules) * 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules)
* 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules) * 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules)
* 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules)
* 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules)
* 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules) * 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules)
* 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules)
* 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules)
* 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules) * 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules)
* 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules)
* 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules) * 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:65039 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65027 <-> DISABLED <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt (server-webapp.rules) * 1:65037 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt (os-windows.rules) * 1:65043 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65042 <-> DISABLED <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt (os-windows.rules) * 1:65038 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt (os-windows.rules) * 1:65028 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65029 <-> DISABLED <-> DELETED FILE-OTHER arbitrary download attempt (deleted.rules) * 1:65030 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:65031 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65032 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65033 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65041 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules) * 1:65034 <-> DISABLED <-> FILE-OFFICE Microsoft Office remote code execution attempt (file-office.rules) * 1:65035 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65036 <-> DISABLED <-> FILE-OFFICE Microsoft Excel remote code execution attempt (file-office.rules) * 1:65026 <-> DISABLED <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt (server-webapp.rules) * 1:65040 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt (os-windows.rules)
* 1:56290 <-> ENABLED <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt (os-windows.rules) * 1:55802 <-> ENABLED <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt (os-windows.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.7.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.9.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:301250 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301251 <-> FILE-OFFICE Microsoft Office remote code execution attempt * 1:301252 <-> FILE-OFFICE Microsoft Excel remote code execution attempt * 1:301253 <-> OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt * 1:301254 <-> OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt * 1:301255 <-> OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt * 1:65026 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass attempt * 1:65027 <-> SERVER-WEBAPP IBM WebSphere Application Server WASPostParam cookie denial of service attempt * 1:65037 <-> OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt
* 1:301220 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:55802 <-> OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt * 1:56290 <-> OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt * 1:64242 <-> SERVER-WEBAPP PTZOptics VHD PTZ Camera authentication bypass and command injection attempt
©2025 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.