Rule Document 1:67355

Rule Category

FILE-OTHER -- Snort detected traffic targeting vulnerabilities in a file type that does not require enough rule coverage to have its own category.

Alert Message

FILE-OTHER FreeRDP rdp configuration file double free attempt

Rule Explanation

This rule looks for a "selectedmonitors:s:" configuration field containing an unusually long numeric monitor identifier in a .rdp file. Successful exploitation can lead to memory corruption and potential remote code execution on the system processing the file.

What To Look For

This rule fires on attempts to exploit a double-free vulnerability in FreeRDP RDP configuration files.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group