Update Details

Update #3337 (12/11/2020)

16 new signatures:

HIGH	SMB:RDS-DATASPACE-RCE	SMB: RDS Dataspace ActiveX Control Remote Code Execution
HIGH	DNS:BEACON-DNS-BACKDR	DNS: BEACON DNS Backdoor
CRITICAL	HTTP:DIR:ATLASSIAN-CONF-ATT-DIR	HTTP: Atlassian Confluence downloadallattachments Directory Traversal
HIGH	APP:KERBEROS:DIRT-JUMPER-TOOLK2	APP: Dirt Jumper Toolkit Variant Detected (2)
HIGH	APP:KERBEROS:DIRT-JUMPER-TOOLKT	APP: Dirt Jumper Toolkit Variant Detected
HIGH	HTTP:RDFLARE-GORAT-BCKDR	HTTP: REDFLARE GORAT Backdoor Detected
LOW	NFS:MSWIN-NFS-NLM-INFO-DISC	NFS: Windows Network File System NLM RPC Message Information Disclosure
HIGH	HTTP:DOS:DIRTJUMPER-2	HTTP: DirtJumper C&C communication-2
HIGH	APP:KERBEROS:DIRT-JUMPER-TOOLK1	APP: Dirt Jumper Toolkit Variant Detected (1)
MEDIUM	HTTP:CTS:ZOHO-SDPLUS-ARB-FILE	HTTP: ZoHo ManageEngine ServiceDesk Plus Arbitrary File Upload
HIGH	SCADA:REDFLARE-GORAT-BCKDR-2	SCADA: REDFLARE GORAT Backdoor Detected
HIGH	HTTP:HEADER:GORAT-BACKDR-COOKIE	HTTP: GORAT Backdoor Detected
HIGH	HTTP:STC:WECON-CHARSIZE-BOF	HTTP: WECON LeviStudioU CharSize Stack Buffer Overflow
HIGH	APP:MISC:RUBEUS-LOGON-PROCESS	APP: Rubeus Hacktool Logon Process Detected
MEDIUM	HTTP:DIR:FORTIOS-SSLVPN-ARBREAD	HTTP: Fortinet FortiOS SSL VPN Unauthenticated Arbitrary File Read
HIGH	HTTP:CTS:ATLASSIAN-CROWD-PDK-CE	HTTP: Atlassian Crowd pdkinstall Plugin Remote Code Execution

1 updated signature:

HIGH

HTTP:DOS:DIRTJUMPER

HTTP: Dirt Jumper C&C Communication

3 renamed signatures:

APP:KERBEROS:FLUFFY-TCP-BCKDR2	->	APP:KERBEROS:DIRT-JUMPER-TOOLK1
APP:KERBEROS:FLUFFY-TCP-BACKDR	->	APP:KERBEROS:DIRT-JUMPER-TOOLK2
APP:KERBEROS:DIRT-JUMPER-TOOLKIT	->	APP:KERBEROS:DIRT-JUMPER-TOOLKT

Details of the signatures included within this bulletin:

SMB:RDS-DATASPACE-RCE - SMB: RDS Dataspace ActiveX Control Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against RDS Dataspace. A successful attack can lead to arbitrary code execution.

Supported On:

idp-5.1.110161014, mx-16.1, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, vsrx3bsd-18.2, srx-18.2, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25857

DNS:BEACON-DNS-BACKDR - DNS: BEACON DNS Backdoor

Severity: HIGH

Description:

This signature detects traffic generated by BEACON DNS Backdoor.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, idp-5.0.0, vsrx-17.4, srx-branch-17.4, isg-3.0.0, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, isg-3.5.141818, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, isg-3.1.134269, vsrx-15.1

References:

HTTP:DIR:ATLASSIAN-CONF-ATT-DIR - HTTP: Atlassian Confluence downloadallattachments Directory Traversal

Severity: CRITICAL

Description:

This signature detects attempts to exploit a known vulnerability against Atlassian Confluence. A successful attack can lead to directory traversal and arbitrary code execution.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

bugtraq: 108067
cve: CVE-2019-3398

Affected Products:

Atlassian confluence 6.14.0
Atlassian confluence 2.0.0
Atlassian confluence 6.13.0
Atlassian confluence 6.7.0

APP:KERBEROS:DIRT-JUMPER-TOOLK2 - APP: Dirt Jumper Toolkit Variant Detected (2)

Severity: HIGH

Description:

This signature detects traffic generated by Dirt Jumper toolkit. A successful attempt may lead to unauthorised access.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, srx-branch-19.1, vsrx-19.2, srx-19.2, srx-branch-19.2, vsrx3bsd-19.2, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, j-series-9.5, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, idp-4.2.110100823, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25899

APP:KERBEROS:DIRT-JUMPER-TOOLKT - APP: Dirt Jumper Toolkit Variant Detected

Severity: HIGH

Description:

This signature detects traffic generated by Dirt Jumper toolkit. A successful attempt may lead to unauthorised access.

Supported On:

References:

HTTP:RDFLARE-GORAT-BCKDR - HTTP: REDFLARE GORAT Backdoor Detected

Severity: HIGH

Description:

This signature detects traffic generated by REDFLARE GORAT Backdoor.

Supported On:

References:

APP:MISC:RUBEUS-LOGON-PROCESS - APP: Rubeus Hacktool Logon Process Detected

Severity: HIGH

Description:

Rubeus hacktool logon process detected. A successful attack can lead to unauthorised access.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

HTTP:DOS:DIRTJUMPER-2 - HTTP: DirtJumper C&C communication-2

Severity: HIGH

Description:

This signature detects command and control traffic generated by the Dirt Jumper DDoS bot. Dirt Jumper can be used to perform distributed denial of service attacks against a large number of victims at once.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25880
url: https://snort.org/rule_docs/1-25882
url: https://snort.org/rule_docs/1-25876

APP:KERBEROS:DIRT-JUMPER-TOOLK1 - APP: Dirt Jumper Toolkit Variant Detected (1)

Severity: HIGH

Description:

This signature detects traffic generated by Dirt Jumper toolkit. A successful attempt may lead to unauthorised access.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25900

HTTP:CTS:ZOHO-SDPLUS-ARB-FILE - HTTP: ZoHo ManageEngine ServiceDesk Plus Arbitrary File Upload

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against ZoHo ManageEngine ServiceDesk Plus. A successful attack can lead to arbitrary code execution.

Supported On:

References:

bugtraq: 107129
cve: CVE-2019-8394

Affected Products:

Zohocorp manageengine_servicedesk_plus

SCADA:REDFLARE-GORAT-BCKDR-2 - SCADA: REDFLARE GORAT Backdoor Detected

Severity: HIGH

Description:

This signature detects traffic generated by REDFLARE GORAT Backdoor.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, idp-5.1.110170603, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, isg-3.1.134269, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25850

HTTP:HEADER:GORAT-BACKDR-COOKIE - HTTP: GORAT Backdoor Detected

Severity: HIGH

Description:

This signature detects traffic generated by GORAT Backdoor.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25848

HTTP:DOS:DIRTJUMPER - HTTP: Dirt Jumper C&C Communication

Severity: HIGH

Description:

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, idp-5.1.110170603, vsrx-15.1

References:

url: https://snort.org/rule_docs/1-25891
url: https://snort.org/rule_docs/1-25884
url: https://snort.org/rule_docs/1-25888
url: https://snort.org/rule_docs/1-25877
url: https://snort.org/rule_docs/1-25889
url: https://snort.org/rule_docs/1-25875
url: https://snort.org/rule_docs/1-25885
url: https://snort.org/rule_docs/1-25878
url: https://snort.org/rule_docs/1-25892
url: https://snort.org/rule_docs/1-25887
url: https://snort.org/rule_docs/1-25874
url: https://snort.org/rule_docs/1-25879
url: https://snort.org/rule_docs/1-25881
url: https://snort.org/rule_docs/1-25894
url: https://snort.org/rule_docs/1-25893
url: http://asert.arbornetworks.com/2011/08/dirt-jumper-caught/

NFS:MSWIN-NFS-NLM-INFO-DISC - NFS: Windows Network File System NLM RPC Message Information Disclosure

Severity: LOW

Description:

This signature detects attempts to exploit a known vulnerability against Windows NFS NLM. A successful attack can lead to sensitive information disclosure.

Supported On:

References:

cve: CVE-2020-17056

Affected Products:

Microsoft windows_server_2016
Microsoft windows_rt_8.1
Microsoft windows_10
Microsoft windows_server_2012
Microsoft windows_8.1
Microsoft windows_server_2019
Microsoft windows_10 20h2
Microsoft windows_server_2016 1909
Microsoft windows_server_2016 2004
Microsoft windows_10 2004
Microsoft windows_server_2016 20h2
Microsoft windows_10 1803
Microsoft windows_10 1909
Microsoft windows_10 1903
Microsoft windows_10 1607
Microsoft windows_server_2012 r2
Microsoft windows_server_2016 1903
Microsoft windows_10 1809

HTTP:STC:WECON-CHARSIZE-BOF - HTTP: WECON LeviStudioU CharSize Stack Buffer Overflow

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Wecon LeviStudiU. The vulnerability is due to improper validation of the length of user-supplied data in the CharSize attribute of HSC files. A remote attacker could exploit this vulnerability by enticing a user into opening a crafted HSC file. Successful exploitation could allow the attacker to execute arbitrary code under the context of users.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, srx-19.4, vsrx3bsd-19.4, srx-branch-19.4, vsrx-19.4, vmx-19.4, mx-19.4, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, idp-5.1.110170603, vsrx-15.1

References:

cve: CVE-2020-16243

HTTP:DIR:FORTIOS-SSLVPN-ARBREAD - HTTP: Fortinet FortiOS SSL VPN Unauthenticated Arbitrary File Read

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Fortinet FortiOS. A successful attack can lead to directory traversal and arbitrary code execution.

Supported On:

References:

bugtraq: 108693
cve: CVE-2018-13379

Affected Products:

Fortinet fortios 5.6.3-5.6.7
Fortinet fortios 6.0.0-6.0.4

HTTP:CTS:ATLASSIAN-CROWD-PDK-CE - HTTP: Atlassian Crowd pdkinstall Plugin Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Atlassian Crowd. A successful attack can lead to arbitrary code execution.

Supported On:

References:

bugtraq: 108637
cve: CVE-2019-11580

Affected Products:

Atlassian crowd 3.3.0
Atlassian crowd 3.2.0
Atlassian crowd 3.1.0
Atlassian crowd 2.1.0
Atlassian crowd 3.4.0