Sid 1-56554

Rule Documentation
References

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER Microsoft Exchange Server 2010 deserialization attempt

Rule Explanation

Microsoft's Exchange 2010 Server suffers from a deserialization vulnerability via it's Exchange Web Services (EWS) SOAP API. Using a valid user account an attacker is able to upload a malicious serialized binary that would allow for remote code execution on the server.

What To Look For

This rule alerts when an attempt to trigger an deserialization vulnerability on a Microsoft's Exchange 2010 server.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic: Execution

Technique: User Execution

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

Additional Links

portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-17144

Rule Vulnerability

Memory Corruption

Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.