Think you have a false positive on this rule?

Sid 1-46233

Message

FILE-OFFICE Microsoft JET Database remote code execution attempt

Summary

This event is generated when JET database engine based remote code execution is attempted in Excel

Impact

Attempted User Privilege Gain

Detailed information

Affected systems

  • MS Excel 2013

Ease of attack

False positives

False negatives

Corrective action

Contributors

  • Cisco's Talos Intelligence Group

Additional References

  • portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-1003