alert tcp any any -> any 62522 (msg:"ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)"; flow:established,to_server; content:"OCSC"; depth:4; content:"vpndownloader.exe"; distance:0; content:"|5c 2e 2e 2f|dbghelp.dll"; fast_pattern; distance:0; reference:url,ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal; reference:url,gist.github.com/ykoster/aeaa893d68adbc5004aa873b3290acd1; reference:cve,2020-3153; classtype:attempted-admin; sid:2030280; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2020_06_10, cve CVE_2020_3153, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_06_10, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)