security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update lateral_movement_dns_server_overflow.toml

Browse Source
This commit is contained in:
Justin Ibarra
2020-07-17 15:52:04 -05:00
committed by GitHub
parent 1cfb8f92bb
commit 1bf60551ff
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/lateral_movement_dns_server_overflow.toml
+1 -1
View File
@@ -20,7 +20,7 @@ false_positives = [
index = ["packetbeat-*", "filebeat-*"]
language = "kuery"
license = "Elastic License"
name = "Abnormally Large DNS Request"
name = "Abnormally Large DNS Response"
note = """### Investigating Large DNS Responses
Detection alerts from this rule indicate an attempt was made to exploit CVE-2020-1350 (SigRed) through the use of large DNS responses on a Windows DNS server. Here are some possible avenues of investigation:
- Investigate any corresponding Intrusion Detection Signatures (IDS) alerts that can validate this detection alert.