SID 1:21322

Rule Category

FILE-OTHER -- Snort detected traffic targeting vulnerabilities in a file type that does not require enough rule coverage to have its own category.

Alert Message

FILE-OTHER Multiple products version.dll dll-load exploit attempt

Rule Explanation

Multiple products are vulnerable to DLL preloading attacks when a malicious version.dll is included in the same directory as various images. Impact: Potential remote code execution on the victim's machine. Details: Rule checks for an attempt to persuade a victim into downloading a malicious version.dll file used in dll preload attacks. Ease of Attack: Medium

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Talos research team.