©2026 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
Microsoft Vulnerability CVE-2026-109473: A coding deficiency exists in Microsoft Windows Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67462 through 67463, Snort 3: GID 1, SID 301743.
Microsoft Vulnerability CVE-2026-112811: A coding deficiency exists in Microsoft Windows Print Spooler Components that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67448 through 67449, Snort 3: GID 1, SID 301736.
Microsoft Vulnerability CVE-2026-119389: A coding deficiency exists in Microsoft Windows Storage that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67446 through 67447, Snort 3: GID 1, SID 301735.
Microsoft Vulnerability CVE-2026-119886: A coding deficiency exists in Microsoft Windows Telephony Service that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67470 through 67471, Snort 3: GID 1, SID 301747.
Microsoft Vulnerability CVE-2026-119992: A coding deficiency exists in Microsoft Windows HTTP.sys that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67472 through 67473, Snort 3: GID 1, SID 301748.
Microsoft Vulnerability CVE-2026-83563: A coding deficiency exists in Microsoft Winlogon that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67254 through 67255, Snort 3: GID 1, SID 301685.
Microsoft Vulnerability CVE-2026-88230: A coding deficiency exists in Microsoft Windows LUA File Virtualization Filter Driver that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67460 through 67461, Snort 3: GID 1, SID 301742.
Microsoft Vulnerability CVE-2026-88242: A coding deficiency exists in Microsoft Windows Ancillary Function Driver for WinSock that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67458 through 67459, Snort 3: GID 1, SID 301741.
Microsoft Vulnerability CVE-2026-94514: A coding deficiency exists in Microsoft Windows Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67456 through 67457, Snort 3: GID 1, SID 301740.
Microsoft Vulnerability CVE-2026-95874: A coding deficiency exists in Microsoft Xbox Gaming Services that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67454 through 67455, Snort 3: GID 1, SID 301739.
Microsoft Vulnerability CVE-2026-95935: A coding deficiency exists in Microsoft Windows Graphics Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67450 through 67451, Snort 3: GID 1, SID 301737.
Microsoft Vulnerability CVE-2026-95983: A coding deficiency exists in Microsoft Windows Graphics Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67483 through 67484, Snort 3: GID 1, SID 301751.
Microsoft Vulnerability CVE-2026-95988: A coding deficiency exists in Microsoft Windows Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67474 through 67475, Snort 3: GID 1, SID 301749.
Microsoft Vulnerability CVE-2026-95989: A coding deficiency exists in Microsoft vhdmp.sys that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67464 through 67465, Snort 3: GID 1, SID 301744.
Microsoft Vulnerability CVE-2026-96126: A coding deficiency exists in Microsoft Windows Graphics Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67468 through 67469, Snort 3: GID 1, SID 301746.
Microsoft Vulnerability CVE-2026-97013: A coding deficiency exists in Microsoft Windows Shell that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67444 through 67445, Snort 3: GID 1, SID 301734.
Microsoft Vulnerability CVE-2026-96077: A coding deficiency exists in Windows TCP/IP stack that may lead to a denial of service.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 116, SIDs 96 through 97, Snort 3: GID 116, SIDs 96 through 97.
Microsoft Vulnerability CVE-2026-83563: A coding deficiency exists in Microsoft Winlogon that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 67254 through 67255, Snort 3: GID 1, SID 301685.
Talos has added and modified multiple rules in the deleted, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:67439 <-> DISABLED <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt (server-webapp.rules) * 1:67440 <-> ENABLED <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt (server-webapp.rules) * 1:67441 <-> DISABLED <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt (server-webapp.rules) * 1:67442 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt (deleted.rules) * 1:67443 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt (deleted.rules) * 1:67444 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt (os-windows.rules) * 1:67445 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt (os-windows.rules) * 1:67446 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt (os-windows.rules) * 1:67447 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt (os-windows.rules) * 1:67448 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt (os-windows.rules) * 1:67449 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt (os-windows.rules) * 1:67450 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67451 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67452 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (deleted.rules) * 1:67453 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (deleted.rules) * 1:67454 <-> DISABLED <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt (os-windows.rules) * 1:67455 <-> DISABLED <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt (os-windows.rules) * 1:67456 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67457 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67458 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt (os-windows.rules) * 1:67459 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt (os-windows.rules) * 1:67460 <-> DISABLED <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt (os-windows.rules) * 1:67461 <-> DISABLED <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt (os-windows.rules) * 1:67462 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67463 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67464 <-> DISABLED <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt (os-windows.rules) * 1:67465 <-> DISABLED <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt (os-windows.rules) * 1:67466 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Desktop Window Manager elevation of privilege attempt (deleted.rules) * 1:67467 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Desktop Window Manager elevation of privilege attempt (deleted.rules) * 1:67468 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67469 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67470 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt (os-windows.rules) * 1:67471 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt (os-windows.rules) * 1:67472 <-> DISABLED <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt (os-windows.rules) * 1:67473 <-> DISABLED <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt (os-windows.rules) * 1:67474 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67475 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67476 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt (deleted.rules) * 1:67477 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt (deleted.rules) * 1:67478 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt (protocol-other.rules) * 1:67479 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt (protocol-other.rules) * 1:67480 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt (protocol-other.rules) * 1:67483 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67484 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 3:67481 <-> ENABLED <-> SERVER-WEBAPP Cisco UCS Central command injection attempt (server-webapp.rules) * 3:67482 <-> ENABLED <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:67473 <-> DISABLED <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt (os-windows.rules) * 1:67472 <-> DISABLED <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt (os-windows.rules) * 1:67439 <-> DISABLED <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt (server-webapp.rules) * 1:67440 <-> ENABLED <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt (server-webapp.rules) * 1:67441 <-> DISABLED <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt (server-webapp.rules) * 1:67442 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt (deleted.rules) * 1:67443 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt (deleted.rules) * 1:67444 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt (os-windows.rules) * 1:67445 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt (os-windows.rules) * 1:67446 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt (os-windows.rules) * 1:67447 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt (os-windows.rules) * 1:67448 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt (os-windows.rules) * 1:67449 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt (os-windows.rules) * 1:67450 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67451 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67452 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (deleted.rules) * 1:67453 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (deleted.rules) * 1:67454 <-> DISABLED <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt (os-windows.rules) * 1:67455 <-> DISABLED <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt (os-windows.rules) * 1:67456 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67457 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67458 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt (os-windows.rules) * 1:67459 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt (os-windows.rules) * 1:67460 <-> DISABLED <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt (os-windows.rules) * 1:67461 <-> DISABLED <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt (os-windows.rules) * 1:67462 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67463 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67464 <-> DISABLED <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt (os-windows.rules) * 1:67465 <-> DISABLED <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt (os-windows.rules) * 1:67466 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Desktop Window Manager elevation of privilege attempt (deleted.rules) * 1:67467 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Desktop Window Manager elevation of privilege attempt (deleted.rules) * 1:67468 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67469 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67470 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt (os-windows.rules) * 1:67475 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67474 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67476 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt (deleted.rules) * 1:67477 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt (deleted.rules) * 1:67478 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt (protocol-other.rules) * 1:67479 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt (protocol-other.rules) * 1:67480 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt (protocol-other.rules) * 1:67483 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67484 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67471 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt (os-windows.rules) * 3:67482 <-> ENABLED <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt (server-webapp.rules) * 3:67481 <-> ENABLED <-> SERVER-WEBAPP Cisco UCS Central command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:67469 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67470 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt (os-windows.rules) * 1:67484 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67472 <-> DISABLED <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt (os-windows.rules) * 1:67475 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67473 <-> DISABLED <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt (os-windows.rules) * 1:67474 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67476 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt (deleted.rules) * 1:67477 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt (deleted.rules) * 1:67478 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt (protocol-other.rules) * 1:67479 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt (protocol-other.rules) * 1:67480 <-> DISABLED <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt (protocol-other.rules) * 1:67483 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67471 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt (os-windows.rules) * 1:67462 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67461 <-> DISABLED <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt (os-windows.rules) * 1:67464 <-> DISABLED <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt (os-windows.rules) * 1:67463 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67465 <-> DISABLED <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt (os-windows.rules) * 1:67466 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Desktop Window Manager elevation of privilege attempt (deleted.rules) * 1:67467 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Desktop Window Manager elevation of privilege attempt (deleted.rules) * 1:67468 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67440 <-> ENABLED <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt (server-webapp.rules) * 1:67439 <-> DISABLED <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt (server-webapp.rules) * 1:67442 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt (deleted.rules) * 1:67441 <-> DISABLED <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt (server-webapp.rules) * 1:67444 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt (os-windows.rules) * 1:67443 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt (deleted.rules) * 1:67445 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt (os-windows.rules) * 1:67446 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt (os-windows.rules) * 1:67448 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt (os-windows.rules) * 1:67447 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt (os-windows.rules) * 1:67450 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67449 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt (os-windows.rules) * 1:67452 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (deleted.rules) * 1:67451 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt (os-windows.rules) * 1:67454 <-> DISABLED <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt (os-windows.rules) * 1:67453 <-> DISABLED <-> DELETED OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (deleted.rules) * 1:67456 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67455 <-> DISABLED <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt (os-windows.rules) * 1:67458 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt (os-windows.rules) * 1:67457 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules) * 1:67460 <-> DISABLED <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt (os-windows.rules) * 1:67459 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt (os-windows.rules) * 3:67481 <-> ENABLED <-> SERVER-WEBAPP Cisco UCS Central command injection attempt (server-webapp.rules) * 3:67482 <-> ENABLED <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.3.5.1.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.3.6.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.3.7.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.7.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.9.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.12.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.11.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.12.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.13.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301734 <-> OS-WINDOWS Microsoft Windows Shell elevation of privilege attempt * 1:301735 <-> OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt * 1:301736 <-> OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt * 1:301737 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301739 <-> OS-WINDOWS Microsoft Xbox Gaming Services elevation of privilege attempt * 1:301740 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301741 <-> OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt * 1:301742 <-> OS-WINDOWS Microsoft Windows LUA File Virtualization Filter Driver elevation of privilege attempt * 1:301743 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301744 <-> OS-WINDOWS Microsoft vhdmp.sys elevation of privilege attempt * 1:301746 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:301747 <-> OS-WINDOWS Microsoft Windows Telephony Service elevation of privilege attempt * 1:301748 <-> OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt * 1:301749 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt * 1:301751 <-> OS-WINDOWS Microsoft Windows Graphics Kernel elevation of privilege attempt * 1:67439 <-> SERVER-WEBAPP ONLYOFFICE Document Server directory traversal attempt * 1:67440 <-> SERVER-WEBAPP Zammad WebSocket session cookie leak attempt * 1:67441 <-> SERVER-WEBAPP PHP multipart empty header flood memory exhaustion attempt * 1:67478 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67479 <-> PROTOCOL-OTHER FreeRDP Kerberos pubKeyAuth wrap token denial of service attempt * 1:67480 <-> PROTOCOL-OTHER FreeRDP Kerberos authInfo wrap token denial of service attempt * 3:67481 <-> SERVER-WEBAPP Cisco UCS Central command injection attempt * 3:67482 <-> SERVER-WEBAPP Cisco UCS Central arbitrary file write attempt
©2026 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.