Cisco Talos Update for FireSIGHT Management Center

Date: 2020-02-20

This SRU number: 2020-02-19-001
Previous SRU number: 2020-02-17-001

Applies to:

3D Sensor versions: 5.x / 6.x
Cisco FireSIGHT Management Center versions: 5.x / 6.x

This SEU number: 2127
Previous SEU: 2126

Applies to:

3D Sensor Versions: 4.10
Cisco FireSIGHT Management Center versions: 4.10

This is the complete list of rules added in SRU 2020-02-19-001 and SEU 2127.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Cisco Talos policy, Connectivity, Balanced, Security, and Maximum Detection.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.	Max.
1	53148	FILE-PDF	Adobe Acrobat CTextWidget memory corruption attempt	off	off	drop	drop
1	53149	FILE-PDF	Adobe Acrobat CTextWidget memory corruption attempt	off	off	drop	drop
1	53150	BROWSER-IE	Microsoft Internet Explorer onscroll use after free attempt	off	off	drop	drop
1	53151	BROWSER-IE	Microsoft Internet Explorer onscroll use after free attempt	off	off	drop	drop
1	53152	MALWARE-CNC	Win.Trojan.CrimsonRAT outbound connection	off	drop	drop	drop
1	53153	MALWARE-CNC	Win.Trojan.CrimsonRAT inbound command	off	drop	drop	drop
1	53154	MALWARE-CNC	Win.Trojan.ObliqueRAT outbound connection	off	drop	drop	drop
1	53155	MALWARE-CNC	Win.Trojan.ObliqueRAT outbound connection	off	drop	drop	drop
1	53156	MALWARE-OTHER	Doc.Dropper.CrimsonRAT download attempt	off	drop	drop	drop
1	53157	MALWARE-OTHER	Doc.Dropper.CrimsonRAT download attempt	off	drop	drop	drop
1	53158	MALWARE-OTHER	Win.Trojan.CrimsonRAT download attempt	off	drop	drop	drop
1	53159	MALWARE-OTHER	Win.Trojan.ObliqueRAT download attempt	off	drop	drop	drop
1	53160	MALWARE-OTHER	Win.Trojan.ObliqueRAT download attempt	off	drop	drop	drop
1	53161	MALWARE-OTHER	Win.Trojan.ObliqueRAT download attempt	off	drop	drop	drop
1	53162	MALWARE-OTHER	Win.Trojan.ObliqueRAT download attempt	off	drop	drop	drop
1	53163	MALWARE-OTHER	Doc.Dropper.ObliqueRAT download attempt	off	drop	drop	drop
1	53164	MALWARE-OTHER	Doc.Dropper.ObliqueRat download attempt	off	drop	drop	drop
1	53165	MALWARE-OTHER	Win.Trojan.CrimsonRAT download attempt	off	drop	drop	drop
1	53166	MALWARE-OTHER	Win.Trojan.CrimsonRAT download attempt	off	drop	drop	drop
1	53167	MALWARE-OTHER	Win.Trojan.CrimsonRAT download attempt	off	drop	drop	drop
3	53168	SERVER-WEBAPP	Cisco Unified Contact Center Express arbitrary JSP file upload attempt	off	drop	drop	drop
3	53169	POLICY-OTHER	PostgreSQL default credential login detected	off	off	alert	alert
3	53171	POLICY-OTHER	Cisco Data Center Network Manager password change detected	off	off	off	off
3	53172	POLICY-OTHER	Cisco Data Center Network Manager user add detected	off	off	off	off
3	53173	POLICY-OTHER	Cisco Data Center Network Manager server properties update detected	off	off	off	off
3	53174	POLICY-OTHER	Cisco Data Center Network Manager saveDefaultCredentials detected	off	off	off	off
3	53175	SERVER-WEBAPP	Cisco Data Center Network Manager cross site request forgery attempt	off	off	drop	drop
3	53176	SERVER-WEBAPP	Cisco Data Center Network Manager cross site request forgery attempt	off	off	drop	drop
1	53177	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53178	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53179	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53180	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53181	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53182	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53183	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53184	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53185	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53186	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53187	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53188	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53189	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53190	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53191	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53192	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53193	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53194	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53195	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53196	MALWARE-OTHER	Doc.Trojan.Valyria variant download attempt	off	off	drop	drop
1	53197	MALWARE-OTHER	Win.Keylogger.WindowsKeylogger variant download attempt	off	off	drop	drop
1	53198	MALWARE-OTHER	Win.Keylogger.WindowsKeylogger variant download attempt	off	off	drop	drop
1	53199	BROWSER-PLUGINS	HP Sprinter Tidestone Formula One DefaultFontName buffer overflow attempt	off	off	off	drop
1	53200	BROWSER-PLUGINS	HP Sprinter Tidestone Formula One DefaultFontName buffer overflow attempt	off	off	off	drop
1	53201	BROWSER-PLUGINS	HP Sprinter Tidestone Formula One DefaultFontName buffer overflow attempt	off	off	off	drop
1	53202	BROWSER-PLUGINS	HP Sprinter Tidestone Formula One DefaultFontName buffer overflow attempt	off	off	off	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.	Max.
3	53170	SERVER-OTHER	Cisco Email Security Appliance mail log parsing denial of service attempt	off	off	off	drop