SID 1:49325

Rule Category

FILE-OTHER -- Snort detected traffic targeting vulnerabilities in a file type that does not require enough rule coverage to have its own category.

Alert Message

FILE-OTHER Microsoft Windows Avast Anti-Virus local credentials disclosure attempt

Rule Explanation

This event is generated when there is a Microsoft Windows Avast Anti-Virus local credentials disclosure attempt. Impact: Attempted User Privilege Gain Details: Avast Anti-Virus before version 19.1.2360 does not properly protect email/password credentials kept in process memory, allowing for malicious scripts to scrape for this information. The rule looks for indicators a downloaded python script will attempt to exploit this vulnerability. Ease of Attack: Simple

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group