OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)
OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt
This event is generated when there is an authentication bypass attempt via NTLMv2 relay attack.
Attempted User Privilege Gain
Event is triggered upon a malicious NTLMv2 Challenge sent from a proxy to a client machine in an attempt to steal a valid session key. This will allow the relayer to use the stolen session key to recalculate MIC and authenticate to the target server.
Ease of Attack:
What To Look For
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
For reference, see the MITRE ATT&CK vulnerability types here:
CVE Additional Information
CVE-2019-1019A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'.
||Ease of Access||HIGH