OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)
OS-WINDOWS Windows Desktop Bridge privilege escalation attempt
This event is generated when an attacker attempts to exploit a privilege escalation vulnerability present in Microsoft Windows Desktop Bridge applications.
Attempted Administrator Privilege Gain
Rule checks for attempts to exploit a privilege escalation vulnerability present in Microsoft Windows Desktop Bridge applications.
Ease of Attack:
What To Look For
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
For reference, see the MITRE ATT&CK vulnerability types here:
CVE Additional Information
CVE-2018-8214An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows Desktop Bridge Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8208.
||Ease of Access||