Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER Microsoft Exchange Server PushSubscriptionRequest setup attempt

Rule Explanation

This event is generated when a PushSubscriptionRequest is sent to a Microsoft Exchange Server. Impact: Potential Corporate Privacy Violation Details: This rule fires when a user sends a PushSubscriptionRequest to a Microsoft Exchange server in order to have all emails get sent back to some remote location. Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This rule will fire on *any* attempt to send a PushSubscriptionRequest to a Microsoft Exchange server in order to have all emails get sent back to some remote location.

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

Additional Links

Rule Vulnerability

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2018-8581
Loading description
CVE-2019-0686
Loading description
CVE-2019-0724
Loading description