| CARVIEW |
Rule Category
BROWSER-IE -- Snort has detected traffic known to exploit vulnerabilities present in the Internet Explorer browser, or products that have the Trident or Tasman engines.
Alert Message
BROWSER-IE Microsoft Edge scripting engine memory corruption attempt
Rule Explanation
This rule looks for bytes known to be specific to files intended to exploit a memory corruption vulnerability vulnerability in the Microsoft Windows Edge browser.
What To Look For
This rule fires on attempts to exploit a memory corruption vulnerability in the Microsoft Windows Edge browser.
Known Usage
No public information
False Positives
No known false positives
Contributors
Cisco Talos Intelligence Group
Rule Groups
MITRE::ATT&CK Framework::Enterprise::Execution::User Execution::Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
T1204.002
MITRE::ATT&CK Framework::Enterprise::Initial Access::Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1189
Rule Categories::Operating Systems::Windows
Rules for detecting attacks against the Windows operating system
Rule Categories::Browser::Internet Explorer
Rules for detecting exploits against the Internet Explorer Web browser
CVE
Additional Links
Rule Vulnerability
Memory Corruption
Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.
CVE Additional Information
This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2025-30397 |
Loading description
|
|
|||||||||||||||||||||||
©2025 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.