SID 1:42785

Rule Category

INDICATOR-SCAN -- Snort detected a system behavior that suggests the system has been affected by malware. That behavior is known as an Indicator of Compromise (IOC). The symptoms could be a wide range of behaviors, from a suspicious file name to an unusual use of a utility. Symptoms do not guarantee an infection; your network configuration may not be affected by malware, but showing indicators as a result of a normal function. This alert showed because Snort has detected a tool or script attempting to find objects on the network. This could be as simple as pinging a specific port that WordPress admins commonly use to see if a WordPress-targeted attack might succeed, or it could be as complex as attempting to create a map of the entire network, including ports, services, and devices. Snort scans the signature of this attempt to determine if it is different from the allowed network scanning tools (such as NMAP), and is therefore likely an attack.

Alert Message

INDICATOR-SCAN DNS version.bind string information disclosure attempt

Rule Explanation

Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 are configured to answer version queries, aka "Windows DNS Server Denial of Service Vulnerability". Impact: CVSS base score 5.9 CVSS impact score 3.6 CVSS exploitability score 2.2 confidentialityImpact NONE integrityImpact NONE availabilityImpact NONE Details: Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Talos research team. This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology. For more information see [nvd].