New Filters:
43258: HTTP: Trojan.MSIL.CordlogasRAT.A Runtime Detection
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Category: Virus
- Severity: High
- Description: This filter is deployed in the Malware Filter Package.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- Release Date: September 19, 2023
43260: HTTP: Trojan.Python.Dipimargos.A Runtime Detection
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Category: Virus
- Severity: High
- Description: This filter is deployed in the Malware Filter Package.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- Release Date: September 19, 2023
43261: HTTP: Backdoor.MSIL.FakeChk.WIE Runtime Detection (C2 Communication)
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Category: Virus
- Severity: High
- Description: This filter is deployed in the Malware Filter Package.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- Release Date: September 19, 2023
43263: SMB: Ransomware.Win32.KuiperLocker.A Runtime Detection
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Category: Virus
- Severity: High
- Description: This filter is deployed in the Malware Filter Package.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- Release Date: September 19, 2023
43264: SMB: Ransomware.Win32.GroundingConductor.A Runtime Detection
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Category: Virus
- Severity: High
- Description: This filter is deployed in the Malware Filter Package.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- Release Date: September 19, 2023
43266: TCP: Backdoor.Win32.Darkme.A Runtime Detection
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Category: Virus
- Severity: High
- Description: This filter is deployed in the Malware Filter Package.
- Deployments:
- Deployment: Default (Block / Notify)
- Deployment: Performance-Optimized (Disabled)
- References:
- Common Vulnerabilities and Exposures: CVE-2023-38831
- Release Date: September 19, 2023
Modified Filters (logic changes):
* = Enabled in Default deployments
* 38698: HTTP: Generic PHP/ASPX Webshell Payload Detected (Request)
- IPS Version: 3.7.0 and after.
- TPS Version: 4.0.0 and after.
- vTPS Version: 4.0.1 and after.
- Name changed from "38698: HTTP: Generic PHP Webshell Payload Detected".
- Description updated.
- Detection logic updated.
- Vulnerability references updated.
- Release Date: January 12, 2021
- Last Modified Date: September 19, 2023
Modified Filters (metadata changes only):
* = Enabled in Default deployments
* 43138: TCP: Backdoor.MSIL.VNCNode.A Runtime Detection
- IPS Version: 3.9.5 and after.
- TPS Version: 5.2.2 and after.
- vTPS Version: 5.2.2 and after.
- Vulnerability references updated.
- Release Date: August 15, 2023
- Last Modified Date: September 19, 2023
Removed Filters: None
|
