Rule Document 1:977

Rule Category

SERVER-IIS -- Snort has detected traffic exploiting vulnerabilities in Microsoft IIS Web Servers.

Alert Message

SERVER-IIS .cnf access

Rule Explanation

This event is generated when an attempt is made to exploit a potential weakness on a host running Microsoft Internet Information Server (IIS). Impact: Information gathering possible administrator access. Details: This event indicates that an attempt has been made to exploit potential weaknesses in a host running Microsoft IIS. The attacker may be trying to gain information on the IIS implementation on the host, this may be the prelude to an attack against that host using that information. The attacker may also be trying to gain administrator access to the host, garner information on users of the system or retrieve sensitive customer information. Some applications may store sensitive information such as database connections, user information, passwords and customer information in files accessible via a web interface. Care should be taken to ensure these files are not accessible to external sources. Ease of Attack: Simple.

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group