SMB: Microsoft Windows HTTP To SMB NTLM Reflection Privilege Escalation

This signature detects attempts to exploit a known vulnerability against Microsoft Windows. A successful attack can lead to elevation of privilege and arbitrary code execution.

Extended Description

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'.

Affected Products

Microsoft windows_server_2016

References

CVE: CVE-2019-1019

URL: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1019

Short Name

SMB:EXPLOIT:HTTP-SMB-REFL

Severity

Minor

Recommended

True

Recommended Action

Drop

SMB: Microsoft Windows HTTP To SMB NTLM Reflection Privilege Escalation

Extended Description

Affected Products

References

Found a potential security threat?