FILE-EXECUTABLE Microsoft Windows data sharing service privilege escalation attempt

Description

Detects the exploitation of CVE-2019-0574, a privilege escalation in the Windows data sharing service. The rule matches the serialized structures that public exploits use to trick the service into running code with elevated privileges.

CVEs

Related malware families

References

• portal.msrc.microsoft.com →