Rule Document 1:64656

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows win32 kernel subsystem escalation of privilege attempt

Rule Explanation

This rule checks for the transfer of a maliciously crafted executable file that will cause the escalation of privilege in a vulnerable Windows computer, via the kernel subsystem of the operating system.

What To Look For

This rule will alert when there's an attempt to exploit an escalation of privilege in the kernel of a Windows computer. This is related to CVE-2025-24983

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group