Skip to content

Instantly share code, notes, and snippets.

@ptresearch

ptresearch/cve-2019-1040.rules

Created October 4, 2019 12:00
Show Gist options
  • Save ptresearch/8c585f4b1d4a36b16d7541b52a6f8040 to your computer and use it in GitHub Desktop.
Save ptresearch/8c585f4b1d4a36b16d7541b52a6f8040 to your computer and use it in GitHub Desktop.
Download ZIP
Drop the MIC detection
Raw
cve-2019-1040.rules
alert smb any any -> any any (msg: "ATTACK [PTsecurity] NTLM without MIC 'Drop the MIC' attack. Possible NTLM Relay"; flow: established, to_server; content: "NTLMSSP|00 03 00 00 00|"; content: "|40 00 00 00|"; within: 48; pcre: "/NTLMSSP\x00\x03\x00\x00\x00(?:........){0,5}[^\x00].[^\x00].\x40\x00\x00\x00/"; reference: cve, 2019-1040; reference: url, dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin; reference: url, github.com/ptresearch/AttackDetection; classtype: attempted-admin; sid: 10005314; rev: 1;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment