Rule Document 1:64853

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Defender for Endpoint Web Threat Defense denial of service attempt

Rule Explanation

This rule looks specially crafted TCP packets intended to exploit a denial of service vulnerability against vulnerable versions of Microsoft Defender for Endpoint Web Threat Defense.

What To Look For

This rule fires on attempts to exploit a denial of service vulnerability against vulnerable versions of Microsoft Defender for Endpoint Web Threat Defense.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group