Release notes for update package 1860-5242

This update package improves the detection capabilities of the Forcepoint LLM system.

RELEASE DATE:     Tuesday April 01, 2025
MD5 CHECKSUM:     3ad60730ea47c85e612598dbccf2a3f8
SHA1 CHECKSUM:     368275edd3dd033610a47e02520884317193fba2
SHA256 CHECKSUM:     f39223fe136eabfa113873250f7f9c87164d6052bad0ac44a559231e13b808f1


UPDATE CRITICALITY:    HIGH

List of detected attacks in this update package:

Risk level Description Reference Vulnerability
High     An attempt to exploit a vulnerability in Mozilla Firefox detected     CVE-2022-1802     Mozilla-Firefox-Prototype-Pollution-CVE-2022-1802
High     An attempt to exploit a vulnerability in SophosEncrypt detected     No CVE/CAN Sophosencrypt-Ransomware
High     A transfer of WannaCry ransomware detected     No CVE/CAN Wannacry-Ransomware
High     A transfer of ESXiArgs ransomware detected     No CVE/CAN Linux-Esxiargs-Ransomware

Jump to: Detected Attacks Other Changes

DETECTED ATTACKS

New detected attacks:

Text File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Mozilla-Firefox-Prototype-Pollution-CVE-2022-1802 CVE-2022-1802 File-Text_Mozilla-Firefox-Prototype-Pollution-CVE-2022-1802 Suspected Compromise

Other Binary File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Linux-Esxiargs-Ransomware No CVE/CAN File-Binary_Linux-Esxiargs-Ransomware Suspected Botnet

Executable File Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type
High Wannacry-Ransomware No CVE/CAN File-Exe_Wannacry-Ransomware Suspected Botnet
High Sophosencrypt-Ransomware No CVE/CAN File-Exe_Sophosencrypt-Ransomware Suspected Botnet

Updated detected attacks:

UDP Packet Unknown

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Kerberos-Multi-Realm-KDC-Null-Pointer-Dereference-Denial-Of-Service CVE-2013-1418 Generic_UDP-Kerberos-Multi-Realm-KDC-Null-Pointer-Dereference-Denial-Of-Service Potential Compromise
Category tag situation Potential Compromise added
Category tag situation Suspected Compromise removed
Fingerprint regexp changed

HTTP Client Stream

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Embedthis-GoAhead-Web-Server-CVE-2021-42342-Cgi-RCE CVE-2021-42342 HTTP_CS-Embedthis-GoAhead-Web-Server-CVE-2021-42342-Cgi-RCE Suspected Compromise
Comment has changed

File Name

Risk Vulnerability/Situation References Related Fingerprint Situation Type Change Description
High Suspicious-Executable-Filename No CVE/CAN File-Name_Suspicious-Executable-Filename Suspected Attack Related Anomalies
Comment has changed
Description has changed

LIST OF OTHER CHANGES:

New objects:

Type Name
Category WannaCry
Category SophosEncrypt
Category ESXiArgs Ransomware
Situation File-Text_Suspicious-Interpreted-Script

Updated objects:

Type Name Changes
Situation File_Blocked-Bad-SHA1-Hash
Detection mechanism updated
IPList TOR exit nodes IP Address List
IPList Amazon AMAZON
IPList Amazon EC2
IPList TOR relay nodes IP Address List
IPList Amazon AMAZON eu-south-2
IPList Amazon EC2 eu-south-2
IPList Malicious Site IP Address List
IPList NordVPN Servers IP Address List
IPList Amazon AMAZON us-east-1
IPList Amazon EC2 us-east-1
IPList Forcepoint Drop IP Address List
IPList Amazon AMAZON us-west-2
Situation File-Binary_Shared-Variables
Application TOR
Application NordVPN

DISCLAIMER AND COPYRIGHT

Copyright © 2025 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.

All other trademarks used in this document are the property of their respective owners.

Every effort has been made to ensure the accuracy of this document. However, Forcepoint makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Forcepoint shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.