Rule Document 1:65675

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows Error Reporting Service privilege escalation attempt

Rule Explanation

This rule looks for attempts to exploit a vulnerability in the Windows Error Reporting Service in windows. Attackers who abuse this may be able to leak sensitive information and/or gain a further foothold on an exploited system.

What To Look For

This rule looks for attempts to exploit an escalation of privilege on Microsoft Windows.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group