馃惥 - 馃毃 Possible exploitation de SIGRed 馃敟 CVE-2020-1350 - RCE sur serveur DNS Windows et Contr么leur Active Directory

SID: 3309543Rev: 11 views
Sourcepawpatrules
CreatedJuly 17, 2020
UpdatedJuly 17, 2020
Classificationtrojan-activity
alert tcp any any -> any any (msg:"馃惥 - 馃毃 Possible exploitation de SIGRed 馃敟 CVE-2020-1350 - RCE sur serveur DNS Windows et Contr么leur Active Directory"; content:"|ff|"; startswith; byte_test:1,>=,0xec,0,relative; content:"|00 00 18|"; distance:12; within:64; fast_pattern; content:"|c0|"; distance:2; within:1; content:"|00 18|"; distance:1; within:2; reference:url,https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin:-exploiting-a-17-year-old-bug-in-windows-dns-servers/; reference:url,https://portal.msrc.microsoft.com/fr-fr/security-guidance/advisory/CVE-2020-1350; reference:url,https://support.microsoft.com/fr-fr/help/4569509/windows-dns-server-remote-code-execution-vulnerability; reference:url,https://www.cert.ssi.gouv.fr/alerte/CERTFR-2020-ALE-16/; reference:cve,2020-1350; metadata:created_at 2020_07_17, updated_at 2020_07_17; sid:3309543; rev:1; classtype:trojan-activity;)

References

urlhttps://research.checkpoint.com/2020/resolving-your-way-into-domain-admin:-exploiting-a-17-year-old-bug-in-windows-dns-servers/
urlhttps://portal.msrc.microsoft.com/fr-fr/security-guidance/advisory/CVE-2020-1350
urlhttps://support.microsoft.com/fr-fr/help/4569509/windows-dns-server-remote-code-execution-vulnerability
urlhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2020-ALE-16/
cve2020-1350

Metadata

created at2020_07_17
updated at2020_07_17

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!