Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself.

Alert Message

OS-WINDOWS Windows kernel win32k driver elevation of privilege attempt

Rule Explanation

This event is generated when an attempt to corrupt the memory of a Windows Kernel driver is performed via a malicious executable. Impact: Local Privilege Escalation Details: The Windows Win32k.sys kernel driver is vulnerable to a memory corruption error that could lead to a local privilege escalation. By creating a malicious executable that targets the creation and destruction of user-mode window callbacks an attacker is able to achieve a use-after-free memory corruption to obtain privileges that they should otherwise not have. Ease of Attack: Medium

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

Additional Links

Rule Vulnerability

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2020-0721
Loading description