The latest release includes 35 new rules, two modified shared object rules and six new shared object rules.
This release provides coverage for many of the vulnerabilities Microsoft disclosed Tuesday as part of its monthly security update. Most notably, there is a DNS vulnerability that was assigned a severity 10 out of 10. Talos also discovered six critical bugs included this month which affected AMD and Intel chips.
There were no changes made to the snort.conf in this release.
Talos's rule release:
Microsoft Vulnerability CVE-2020-1147: A coding deficiency exists in .NET Framework, SharePoint Server, and Visual Studio that may lead to remote code execution.You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. Make sure and stay up to date to catch the most emerging threats.
A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 54511.
Microsoft Vulnerability CVE-2020-1350: A coding deficiency exists in Microsoft Windows DNS server that may lead to remote code execution.
A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 54518.
Microsoft Vulnerability CVE-2020-1374: A coding deficiency exists in Remote Desktop Client that may lead to remote code execution.
A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 54523.
Microsoft Vulnerability CVE-2020-1381: A coding deficiency exists in Microsoft Windows Graphics Component that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 54521 through 54522.
Microsoft Vulnerability CVE-2020-1382: A coding deficiency exists in Microsoft Windows Graphics Component that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 54512 through 54515.
Microsoft Vulnerability CVE-2020-1399: A coding deficiency exists in Microsoft Windows Runtime that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 54534 through 54535.
Microsoft Vulnerability CVE-2020-1403: A coding deficiency exists in Microsoft Windows VBScript that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 54509 through 54510.
Microsoft Vulnerability CVE-2020-1410: A coding deficiency exists in Microsoft Windows Address Book that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 54528 through 54533.
Microsoft Vulnerability CVE-2020-1426: A coding deficiency exists in Microsoft Windows Kernel that may lead to information disclosure.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 54516 through 54517.
Talos also has added and modified multiple rules in the browser-chrome, browser-ie, file-executable, file-other, malware-cnc, malware-other, os-other, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.