SID 3:15453

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself.

Alert Message

OS-WINDOWS SMB replay attempt via NTLMSSP - overlapping encryption keys detected

Rule Explanation

Microsoft Windows 2000, Windows XP, Server 2003, Vista, and Server 2008 allows remote SMBv1 servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability."

What To Look For

Snort has detected traffic targeting vulnerabilities in SMBv1 on Windows-based operating systems.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group This document was generated from data supplied by the U.S. National Vulnerability Database, a product of the U.S. National Institute of Standards and Technology. For more information see [nvd].