FILE-EXECUTABLE Microsoft Windows NTFS privilege escalation attempt

Description

Detects the exploitation of CVE-2018-8411 and CVE-2019-1170, privilege escalation flaws in Windows NTFS handling. The rule matches the crafted file operations that public exploits use to corrupt the filesystem driver's memory.

CVEs

Related malware families

References

• portal.msrc.microsoft.com →
• msrc.microsoft.com →