Rule Document 1:67322

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows shell security feature bypass attempt

Rule Explanation

This rule looks for Microsoft Windows settings files that reference the Windows Terminal. User interaction with these files may not properly indicate that their web origin and can result in arbitrary command execution.

What To Look For

This rule alerts on web traffic containing Microsoft Windows settings files that attempt to run arbitrary commands.

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

This rule alerts on all Microsoft Windows settings files that contain terminal references.

Contributors

Cisco Talos Intelligence Group