Rule Document 1:59502

Report a false positive

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself.

Alert Message

OS-WINDOWS Microsoft Windows Server 2003 smart card authentication buffer overflow attempt

Rule Explanation

This rule will look for RDP traffic indicating the use of a security access card and the static memory address where a buffer is stored in Windows Server 2003 allowing user access to stored shellcode.

What To Look For

This rule alerts on RDP network traffic used in the NSA Exploit ESTEEMAUDIT

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

CVE-2017-0176 CVE-2017-9073

Additional Links

www.securitytracker.com/id/1038264

Rule Vulnerability

Buffer Overflow

Buffer Overflows occur when a memory location is filled past its expected boundaries. Computer attackers target systems without proper terminating conditions on buffers, which then write the additional information in other locations in memory, overwriting what is there. This could corrupt the data, making the system behave erratically or crash. The new information could include malicious executable code, which might be executed.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2017-0176
 Loading description
CVE-2017-9073
 Loading description

MITRE ATT&CK Framework

Tactic: Execution

Technique: System Services

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org