Cisco Talos released the newest SNORTⓇ rule update, coinciding with Microsoft Patch Tuesday. Here's an overview of today's rule release:
| Shared object rules | Modified shared object rules | New rules | Modified rules |
|---|---|---|---|
| 6 | 0 | 59 | 513 |
Thursday's release provides several rules to protect against vulnerabilities in an array of Microsoft's products. For more on Patch Tuesday, check out the full blog over on the Talos site here.
Microsoft Vulnerability CVE-2020-16896: A coding deficiency exists in Remote Desktop Protocol (RDP) that may lead to information disclosure.A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 55994.Microsoft Vulnerability CVE-2020-16898: A coding deficiency exists in Microsoft Windows TCP/IP that may lead to remote code execution.A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 55984.Microsoft Vulnerability CVE-2020-16899: A coding deficiency exists in Microsoft Windows TCP/IP that may lead to denial of service.A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 55993.Microsoft Vulnerability CVE-2020-16907: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 55942 through 55943.Microsoft Vulnerability CVE-2020-16913: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 55989 through 55990.Microsoft Vulnerability CVE-2020-16915: A coding deficiency exists in Microsoft Media Foundation that may lead to remote code execution.Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 55979 through 55980.Microsoft Vulnerability CVE-2020-16922: A coding deficiency exists in Microsoft Windows that may lead to spoofing.Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 55982 through 55983.Talos also has added and modified multiple rules in the file-multimedia, file-other, malware-cnc, malware-other, os-windows, protocol-icmp and server-webapp rule sets to provide coverage for emerging threats from these technologies.
You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. Make sure and stay up to date to catch the most emerging threats.