ET EXPLOIT Windows DNS Server RCE Attempt Inbound (CVE-2021-26897)

SID: 2032348Rev: 177 viewsHistory

Sourceet/open

CreatedMarch 30, 2021

UpdatedMarch 30, 2021

Classificationattempted-admin

alert tcp any any -> $DNS_SERVERS 53 (msg:"ET EXPLOIT Windows DNS Server RCE Attempt Inbound (CVE-2021-26897)"; dsize:>1300; content:"|29 00|"; offset:2; depth:2; threshold:type limit, count 45, seconds 90, track by_src; reference:cve,2021-26897; classtype:attempted-admin; sid:2032348; rev:1; metadata:attack_target DNS_Server, created_at 2021_03_30, cve CVE_2021_26897, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_30;)

References

cve	2021-26897

Metadata

attack targetDNS_Server

created at2021_03_30

cveCVE-2021-26897

deploymentInternal

confidenceMedium

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2021_03_30

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!