Rule Document 1:66802

Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER Microsoft Windows Admin Center potential remote code execution attempt

Rule Explanation

This rule looks for HTTP requests being sent to the Windows Admin Center that could indicate potential attempts to exploit a vulnerability that allows for arbitrary command execution.

What To Look For

This rule fires on potential attempts to exploit a vulnerability in the Windows Admin Center.

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This rule may alert on legitimate usage of certain Windows Admin Center functionality, and so network administrators should investigate all events to determine maliciousness.

Contributors

Cisco Talos Intelligence Group