升級包下載：SP_005_Data.2022.10.26.010234.zip
【增加規(guī)則庫詳情】
優(yōu)化以下安全事件：
USER_AGENTS Observed Suspicious UA (NSISDL/1.2 (Mozilla))|主機(jī)發(fā)起可疑用戶代理(NSISDL/1.2 (Mozilla))
POLICY External IP Address Lookup via ifconfig .co|主機(jī)發(fā)起ifconfig.co地址查詢請求
TROJAN ELF/Mirai Variant Momentum User-Agent Observed Inbound|WEB服務(wù)器收到Mirai木馬用戶代理Momentum請求
POLICY External IP Address Lookup via ident .me|主機(jī)發(fā)起ident.me地址查詢請求
POLICY External IP Lookup (whois .pconline .com .cn)|主機(jī)發(fā)起whois.pconline.com.cn地址查詢請求
POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)|主機(jī)發(fā)起api.ip.sb域名查詢請求
POLICY External IP Lookup www.trackip.net|主機(jī)發(fā)起www.trackip.net地址查詢請求
EXPLOIT Microsoft Exchange Pre-Auth Path Confusion M1 (CVE-2021-31207)|服務(wù)器遭受Exchange預(yù)認(rèn)證路徑繞過攻擊
TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1|主機(jī)的Ransomware勒索病毒發(fā)起killswitch域名請求
EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965)|WEB服務(wù)器受到Spring Framework RCE攻擊(CVE-2022-22965)設(shè)置Pattern
EXPLOIT Possible Spring Cloud Connector RCE Inbound (CVE-2022-22963)|WEB服務(wù)器受到Spring Cloud RCE攻擊(CVE-2022-22963)
EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965)|WEB服務(wù)器受到Spring Framework RCE攻擊(CVE-2022-22965)設(shè)置Suffix
EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965)|WEB服務(wù)器受到Spring Framework RCE攻擊(CVE-2022-22965)設(shè)置Directory
EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965)|WEB服務(wù)器受到Spring Framework RCE攻擊(CVE-2022-22965)設(shè)置Prefix
USER_AGENTS Observed Graftor/LoadMoney Related User-Agent|主機(jī)發(fā)起Graftor木馬的用戶代理
USER_AGENTS Observed Graftor/LoadMoney Related User-Agent|主機(jī)發(fā)起Graftor木馬的用戶代理
USER_AGENTS Observed Malicious User-Agent (FastInvoice)|主機(jī)發(fā)起惡意用戶代理(FastInvoice)
POLICY Suspicious Request for .bin with Terse Headers|主機(jī)發(fā)起可疑的.bin請求頭
MALWARE pdfspeedup Initial CnC Checkin|主機(jī)的pdfspeedup工具初始化登錄請求
MALWARE pdfspeedup Keep-Alive|主機(jī)的pdfspeedup工具正在使用
刪除以下安全事件：
External IP Lookup SSL/TLS Certificate (ifconfig .me)
主機(jī)發(fā)起可疑用戶代理(NSISDL/1.2 (Mozilla))
Quad9 DNS通過TLS證書入站
【影響范圍】
1、支持在發(fā)布的任何版本上升級
2、升級完成后，設(shè)備不會重啟。偶現(xiàn)升級后無法返回登錄頁面。請于升級十分鐘后刷新登錄頁面
3、升級包升級完成后，版本號保持不變，策略庫版本更新為Data.2022.10.26.010234
