Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER SSL/TLS weak RC4 cipher suite use attempt

Rule Explanation

This event is generated when a weak SSL/TLS RC4 cipher suite is detected. Impact: Potential Corporate Privacy Violation Details: Ease of Attack:

What To Look For

This rule alerts when an attempt to enumerate weak cipher suites is being performed.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic: Discovery

Technique: Account Discovery

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

Rule Vulnerability

CVE Additional Information

CVE-2015-2808
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Details
SeverityMEDIUM Base Score4.3
Impact Score2.9 Exploit Score8.6
Confidentiality ImpactPARTIAL Integrity ImpactNONE
Availability ImpactNONE Access Vector
AuthenticationNONE Ease of Access