SID 1:47570

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER MikroTik RouterOS Winbox user.dat file read attempt

Rule Explanation

This event is generated when an attacker attempts to exploit an arbitrary file read vulnerability to get the router's credentials. Impact: Attempted Administrator Privilege Gain Details: Rule checks for attempts to exploit an arbitrary file read vulnerability in MikroTik RouterOS to get the router's credentials. Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group