Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt

Rule Explanation

This event is generated when there is an authentication bypass attempt via NTLMv2 relay attack. Impact: Attempted User Privilege Gain Details: Event is triggered upon a malicious NTLMv2 Challenge sent from a proxy to a client machine in an attempt to steal a valid session key. This will allow the relayer to use the stolen session key to recalculate MIC and authenticate to the target server. Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives


Cisco Talos Intelligence Group

MITRE ATT&CK Framework



For reference, see the MITRE ATT&CK vulnerability types here:


Additional Links

CVE Additional Information

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'.
Severity Base Score8.5
Impact Score6.0 Exploit Score1.8
Confidentiality ImpactHIGH Integrity ImpactHIGH
Availability ImpactHIGH Attack VectorNETWORK
ScopeCHANGED User InteractionNONE
Authentication Ease of AccessHIGH
Privileges RequiredLOW