Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows NT CipFixImageType out of bounds read attempt

Rule Explanation

This event is generated when a Windows Kernel out-of-bound read attempt is detected. Impact: Attempted User Privilege Gain Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives


Cisco Talos Intelligence Group

MITRE ATT&CK Framework



For reference, see the MITRE ATT&CK vulnerability types here:


Additional Links

Rule Vulnerability

CVE Additional Information

An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory, aka 'Windows Code Integrity Module Information Disclosure Vulnerability'.
SeverityLOW Base Score2.1
Impact Score2.9 Exploit Score3.9
Confidentiality ImpactPARTIAL Integrity ImpactNONE
Availability ImpactNONE Access VectorLOCAL
AuthenticationNONE Ease of AccessLOW