| CARVIEW |
Rule Category
OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)
Alert Message
OS-WINDOWS Microsoft Windows MapUrlToZone security feature bypass attempt
Rule Explanation
This rule looks for a reference to an external resource known to bypass the MapUrlToZone security feature.
What To Look For
This rule fires on attempts to download a file containing a reference known to bypass the MapUrlToZone security feature.
Known Usage
No public information
False Positives
No known false positives
Contributors
Cisco Talos Intelligence Group
Rule Groups
MITRE::ATT&CK Framework::Enterprise::Initial Access::Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
T1566
MITRE::ATT&CK Framework::Enterprise::Execution::User Execution::Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
T1204.002
Rule Categories::Operating Systems::Windows
Rules for detecting attacks against the Windows operating system
CVE
Additional Links
Rule Vulnerability
N/A
Not Applicable
CVE Additional Information
This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2025-21269 |
Loading description
|
|
|||||||||||||||||||||||
©2025 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.