Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows Common Log File information disclosure attempt

Rule Explanation

This event is generated when a Microsoft Windows Common Log File information disclosure attempt is detected. Impact: Attempted Information Leak Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

Additional Links

CVE Additional Information

CVE-2019-1219
An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Transaction Manager Information Disclosure Vulnerability'.
Details
SeverityLOW Base Score2.1
Impact Score2.9 Exploit Score3.9
Confidentiality ImpactPARTIAL Integrity ImpactNONE
Availability ImpactNONE Access VectorLOCAL
AuthenticationNONE Ease of AccessLOW