Rule Category

BROWSER-IE -- Snort has detected traffic known to exploit vulnerabilities present in the Internet Explorer browser, or products that have the Trident or Tasman engines.

Alert Message

BROWSER-IE Microsoft Internet Explorer memory corruption attempt

Rule Explanation

This event is generated when an attempt to exploit CVE-2018-8249 over file transport methods (such as HTTP, FTP) is detected. Impact: Successful exploitation of this vulnerability could result in remote code execution under the user's current permissions. Details: CVE-2018-8249 is a memory corruption vulnerability in Microsoft Internet Explorer 11. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely. Ease of Attack: Medium

What To Look For

Known Usage

No public information

False Positives

No known false positives


Cisco Talos Intelligence Group

MITRE ATT&CK Framework



For reference, see the MITRE ATT&CK vulnerability types here:


Additional Links

Rule Vulnerability

CVE Additional Information

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-0978.
Severity Base Score7.5
Impact Score5.9 Exploit Score1.6
Confidentiality ImpactHIGH Integrity ImpactHIGH
Availability ImpactHIGH Access Vector
Authentication Ease of Access