HTTP: Microsoft Device Guard and Powershell CVE-2017-0215 Security Bypass

This signature detects attempts to exploit a known vulnerability against Microsoft Device Guard and Powershell. Attackers can bypass security restrictions on directories enabling them to view, edit, and download information.

Extended Description

Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This CVE ID is unique from CVE-2017-0173, CVE-2017-0216, CVE-2017-0218, and CVE-2017-0219.

Affected Products

Microsoft windows_server_2016

References

CVE: CVE-2017-0215

Short Name

HTTP:STC:DL:CVE-2017-0215-SB

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Microsoft Device Guard and Powershell CVE-2017-0215 Security Bypass

Extended Description

Affected Products

References

Found a potential security threat?