Think you have a false positive on this rule?

Sid 1-50068

Message

OS-WINDOWS Microsoft Windows arbitrary registry access privilege escalation attempt

Summary

This event is generated when an attacker attempts to exploit a privilege escalation vulnerability in Microsoft Windows registry.

Impact

Privilege escalation Information disclosure RCE

Detailed information

Affected systems

  • Microsoft Windows Systems

Ease of attack

False positives

None known

False negatives

None known

Corrective action

Contributors

  • Cisco Talos Intelligence Group

Additional References

  • CVE-2019-0931
  • portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0931