🐾 - 🚨 Exploitation possible - multiples RCE dans Microsoft Exchange 📫 - HAFNIUM Group 🇨🇳 - Suricata Rule 3309608 (pawpatrules)

🐾 - 🚨 Exploitation possible - multiples RCE dans Microsoft Exchange 📫 - HAFNIUM Group 🇨🇳

SID: 3309608Rev: 10 views

Sourcepawpatrules

CreatedMarch 3, 2021

UpdatedMarch 3, 2021

Classificationtrojan-activity

alert tcp any any -> $HOME_NET any (msg:"🐾 - 🚨 Exploitation possible - multiples RCE dans Microsoft Exchange 📫 - HAFNIUM Group 🇨🇳"; content:"POST"; content:"/owa/auth/Current/themes/resources/lgnbotl.gif"; reference:url,https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/; reference:url,https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/; metadata:created_at 2021_03_03, updated_at 2021_03_03; sid:3309608; rev:1; classtype:trojan-activity;)

References

url	https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
url	https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

🐾 - 🚨 Exploitation possible - multiples RCE dans Microsoft Exchange 📫 - HAFNIUM Group 🇨🇳

References

Metadata

Comments (0)