Cisco Talos Update for FireSIGHT Management Center

Date: 2020-01-09

This SRU number: 2020-01-08-001
Previous SRU number: 2020-01-06-001

Applies to:

3D Sensor versions: 5.x / 6.x
Cisco FireSIGHT Management Center versions: 5.x / 6.x

This SEU number: 2109
Previous SEU: 2108

Applies to:

3D Sensor Versions: 4.10
Cisco FireSIGHT Management Center versions: 4.10

This is the complete list of rules added in SRU 2020-01-08-001 and SEU 2109.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Cisco Talos policy, Connectivity, Balanced, Security, and Maximum Detection.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.	Max.
1	52550	SERVER-WEBAPP	Technicolor TD5130v2 TD5336 routers command injection attempt	off	off	drop	drop
1	52551	SERVER-WEBAPP	Technicolor TD5130v2 TD5336 routers command injection attempt	off	off	drop	drop
1	52552	SERVER-WEBAPP	Technicolor TD5130v2 TD5336 routers command injection attempt	off	off	drop	drop
1	52553	SERVER-WEBAPP	Technicolor TD5130v2 TD5336 routers command injection attempt	off	off	drop	drop
1	52554	MALWARE-CNC	Unix.Trojan.Mirai variant outbound Technicolor TD5130v2 TD5336 routers command injection attempt	off	drop	drop	drop
3	52555	SERVER-WEBAPP	Cisco Webex Video Mesh Node command injection attempt	off	off	drop	drop
3	52559	SERVER-WEBAPP	Cisco IOS Web UI cross site request forgery attempt	off	off	off	drop
3	52560	SERVER-WEBAPP	Cisco IOS Web UI cross site request forgery attempt	off	off	off	drop
1	52561	POLICY-OTHER	Yachtcontrol webserver unauthenticated remote code execution attempt	off	off	drop	drop
1	52562	POLICY-OTHER	Yachtcontrol webserver unauthenticated remote code execution attempt	off	off	drop	drop
1	52563	MALWARE-CNC	Unix.Trojan.Mirai variant outbound Yachtcontrol webserver unauthenticated remote code execution attempt	off	drop	drop	drop
1	52564	MALWARE-CNC	Unix.Trojan.Mirai variant outbound Yachtcontrol webserver unauthenticated remote code execution attempt	off	drop	drop	drop
1	52569	BROWSER-FIREFOX	Mozilla multiple products SharedWorker MessagePort memory corruption attempt	off	off	off	drop
3	52570	FILE-OTHER	TRUFFLEHUNTER TALOS-2019-0973 attack attempt	off	off	drop	drop
3	52571	FILE-OTHER	TRUFFLEHUNTER TALOS-2019-0973 attack attempt	off	off	drop	drop
1	52572	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52573	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52574	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52575	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52576	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52577	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52578	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52579	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52580	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52581	MALWARE-OTHER	Win.Trojan.ZeroCleare variant payload download attempt	off	off	drop	drop
1	52582	BROWSER-IE	Microsoft Edge object manipulation use-after-free attempt	off	off	off	drop
1	52583	BROWSER-IE	Microsoft Edge object manipulation use-after-free attempt	off	off	off	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.	Max.
1	52565	DELETED	OS-WINDOWS Microsoft Windows hacking attempt	off	off	off	off
1	52566	DELETED	OS-WINDOWS Microsoft Windows hacking attempt	off	off	off	off
1	52567	DELETED	OS-WINDOWS Microsoft Windows hacking attempt	off	off	off	off
1	52568	DELETED	OS-WINDOWS Microsoft Windows hacking attempt	off	off	off	off