Rule Document 1:65113

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows Win32k driver escalation of privilege attempt

Rule Explanation

This rule looks for file transfer traffic containing files that exploit a vulnerability in the win32k driver of Windows for escalation of privileges.

What To Look For

This rule alerts on attempts to exploit an escalation of privilege vulnerability in Microsoft Windows win32k driver.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group