Microsoft | Netskope Threat Labs

Description

Microsoft is a generic detection name for malware targeting Microsoft products.

Stats

First seen: April 2022
Last seen: October 2026

Alert name variants

Alert Name	Engine
Document-HTML.Phishing.Microsoft	ATP Sandbox Adv. Heuristics
Email-MIME.Phishing.Microsoft	ATP Sandbox Adv. Heuristics
MacOS.Phishing.Microsoft	ATP Sandbox Adv. Heuristics
Script-JS.Phishing.Microsoft	ATP Sandbox Adv. Heuristics
Script-PHP.Phishing.Microsoft	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
BROWSER-IE Microsoft Defender memory corruption attempt	IPS-SWG
BROWSER-IE Microsoft Edge anonymous function type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge App-v vbs command attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge Chakra floating point type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge Chakra JIT BoundFunction NewInstance out of bounds read attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge Chakra PreVisitCatch memory corruption attempt	IPS-SWG
BROWSER-IE Microsoft Edge Chakra Scripting Engine localeCompare type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge Chakra scripting engine memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge Chakra scripting engine type confusion attempt	IPS-CFW
BROWSER-IE Microsoft Edge defineGetter type confusion attempt	IPS-CFW
BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt	IPS-CFW
BROWSER-IE Microsoft Edge EntrySimpleSlotGetter use after free attempt	IPS-SWG
BROWSER-IE Microsoft Edge HandleColumnBreakOnColumnSpanningElement type confusion attempt	IPS-SWG
BROWSER-IE Microsoft Edge information disclosure attempt	IPS-SWG
BROWSER-IE Microsoft Edge JavaScript optimization memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge JsSetCurrentContext out of bounds read attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge memory corruption exploitation attempt	IPS-CFW
BROWSER-IE Microsoft Edge null pointer dereference attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge out of bounds write attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge parseFloat type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge PDF PostScript calculator out of bounds read attempt	IPS-SWG
BROWSER-IE Microsoft Edge print function information disclosure attempt	IPS-SWG
BROWSER-IE Microsoft Edge prototype JsBuiltInEngineInterfaceExtensionObject use-after-free attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge resource entry same-origin-policy bypass attempt	IPS-SWG
BROWSER-IE Microsoft Edge sandbox escape attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge Scripting Engine array memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge scripting engine integer overflow attempt	IPS-CFW
BROWSER-IE Microsoft Edge scripting engine Map prototype memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge scripting engine memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge scripting engine security bypass css attempt	IPS-SWG
BROWSER-IE Microsoft Edge scripting engine type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge scripting engine use after free attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge setSelectionRange memory corruption attempt	IPS-CFW
BROWSER-IE Microsoft Edge type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge type confusion code execution attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Edge type confusion vulnerability attempt	IPS-CFW
BROWSER-IE Microsoft Edge VBScript VarType out of bounds read attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer 10 use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer 11 type confusion vulnerability attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer 11 VBScript execution policy bypass attempt	IPS-CFW
BROWSER-IE Microsoft Internet Explorer 11 VBScript redim preserve denial-of-service attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer Array out of bounds write attempt	IPS-CFW
BROWSER-IE Microsoft Internet Explorer BooleanProtoObj objects JSONStringifyArray use-after-free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer CDispContainer out of bounds read attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer CDispNode float css element use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer CGeneratedTreeNode use-after-free attempt	IPS-CFW
BROWSER-IE Microsoft Internet Explorer CInput use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer CLabelElement object use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer CLayout object user after free attempt	IPS-CFW
BROWSER-IE Microsoft Internet Explorer CSVGHelpers use-after-free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer CTreePos type confusion attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer embedSWF use after free exploit attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer EMF file integer overflow attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer frameBorder denial of service attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected	IPS-SWG
BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer Jscript.Encode out-of-bounds read attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer loadXML parseError.errorCode information disclosure attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer localeCompare use after free attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer MHTML XXE external entity attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer moveEnd information disclosure attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer MSHTML CTreePos remote code execution attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer MSHTML Parsing DoS attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer MSHTML platform spoofing attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer object clone deletion memory corruption	IPS-SWG
BROWSER-IE Microsoft Internet Explorer object property change use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer out of bounds read attempt	IPS-CFW
BROWSER-IE Microsoft Internet Explorer page layout use after free attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer ProgID arbitrary code execution attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer scripting engine memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer security zone bypass attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer tagged integer type confusion attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer textarea type confusion attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer type confusion vulnerability attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer uninitialized pointer attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer VBScript engine memory corruption attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer VBScript Engine remote code execution attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Internet Explorer VBScript engine use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer VBScript toString redim array use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer VML shape object malformed path attempt	IPS-SWG
BROWSER-IE Microsoft Internet Explorer VML use after free attempt	IPS-SWG
BROWSER-IE Microsoft Internet print table of links cross site scripting attempt	IPS-SWG
BROWSER-IE Microsoft Windows Edge array out of bounds write	IPS-SWG
BROWSER-IE Microsoft Windows Edge memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Windows Scripting Engine memory corruption attempt	IPS-CFWIPS-SWG
BROWSER-IE Microsoft Windows Scripting Engine use-after-free attempt	IPS-SWG
BROWSER-OTHER Microsoft Edge url spoofing attempt	IPS-CFWIPS-SWG
BROWSER-PLUGINS Microsoft Internet Explorer CapiCom.Utilities ActiveX control getRandom method access attempt	IPS-SWG
BROWSER-PLUGINS Microsoft Office Outlook View OVCtl ActiveX clsid access	IPS-SWG
BROWSER-PLUGINS Microsoft Works WkImgSrv.dll ActiveX clsid access attempt	IPS-SWG
FILE-EXECUTABLE Microsoft Windows data sharing service privilege escalation attempt	IPS-CFW
FILE-EXECUTABLE Microsoft Windows Defender buffer overflow attempt	IPS-SWG
FILE-EXECUTABLE Microsoft Windows Desktop Window Manager use-after-free attempt	IPS-SWG
FILE-EXECUTABLE Microsoft Windows NTFS privilege escalation attempt	IPS-CFW
FILE-IDENTIFY Microsoft asf file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft Compound File Binary v3 file magic detected	IPS-CFWIPS-SWG
FILE-IDENTIFY Microsoft Internet Shortcut file attachment detected	IPS-CFW
FILE-IDENTIFY Microsoft Internet Shortcut file download request	IPS-SWG
FILE-IDENTIFY Microsoft LNK file download request	IPS-CFWIPS-SWG
FILE-IDENTIFY Microsoft Media Player asf/wmv/wma file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft Office Excel file download request	IPS-SWG
FILE-IDENTIFY Microsoft Office Excel file magic detected	IPS-CFWIPS-SWG
FILE-IDENTIFY Microsoft Office Excel xlw file magic detected	IPS-CFWIPS-SWG
FILE-IDENTIFY Microsoft Office PowerPoint file download request	IPS-SWG
FILE-IDENTIFY Microsoft Office PowerPoint file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft Office PowerPoint pptx file download request	IPS-SWG
FILE-IDENTIFY Microsoft Office Word docx file download request	IPS-SWG
FILE-IDENTIFY Microsoft Office Word file download request	IPS-SWG
FILE-IDENTIFY Microsoft OneNote file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft OneNote with embedded structure detected	IPS-SWG
FILE-IDENTIFY Microsoft Software Installer MSI binary file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft Windows .NET Application file download request	IPS-SWG
FILE-IDENTIFY Microsoft Windows CAB file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft Windows Media ASF file magic detected	IPS-SWG
FILE-IDENTIFY Microsoft Windows Media wmv file download request	IPS-SWG
FILE-IMAGE Microsoft Windows Graphics Component remote code execution attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Excel remote code execution attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft MSHTML ActiveX control bypass attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft MSHTML Remote Code Execution Vulnerability	IPS-SWG
FILE-OFFICE Microsoft Office api-ms-win-core-winrt-l1-1-0.dll dll-load exploit attempt	IPS-SWG
FILE-OFFICE Microsoft Office custom message class security bypass attempt	IPS-CFW
FILE-OFFICE Microsoft Office directory traversal attempt	IPS-SWG
FILE-OFFICE Microsoft Office document with auto-start VBA macro detected	IPS-SWG
FILE-OFFICE Microsoft Office EPS restore command use after free attempt	IPS-SWG
FILE-OFFICE Microsoft Office Equation Editor object stack buffer overflow attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Equation Editor object with automatic execution embedded in RTF attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Equation Editor Package objclass RTF evasion attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Equation Editor RTF embedded OLE evasion attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Equation Editor RTF evasion attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Equation Editor stack buffer overflow attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Excel protected view bypass attempt	IPS-SWG
FILE-OFFICE Microsoft Office Excel SxView heap overflow attempt	IPS-SWG
FILE-OFFICE Microsoft Office Excel type confusion attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Excel Viewer remote code execution attempt	IPS-SWG
FILE-OFFICE Microsoft Office font object type confusion attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office HTML remote code execution attempt	IPS-SWG
FILE-OFFICE Microsoft Office None type objclass RTF evasion attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office OLE UtOlePresStmToContentsStm memory corruption attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Outlook appointment privilege escalation attempt	IPS-SWG
FILE-OFFICE Microsoft Office Outlook email parsing remote code execution attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Outlook Express NNTP response overflow attempt	IPS-CFW
FILE-OFFICE Microsoft Office Outlook HTML acronym tag memory corruption attempt	IPS-CFW
FILE-OFFICE Microsoft Office Outlook remote code execution attempt	IPS-SWG
FILE-OFFICE Microsoft Office Powerpoint remote code execution attempt	IPS-SWG
FILE-OFFICE Microsoft Office remote code execution attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office RTF font table memory corruption attempt	IPS-SWG
FILE-OFFICE Microsoft Office RTF malformed pfragments field	IPS-SWG
FILE-OFFICE Microsoft Office RTF object remote code execution attempt	IPS-SWG
FILE-OFFICE Microsoft Office security feature bypass attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office thumbnail bitmap invalid biClrUsed attempt	IPS-SWG
FILE-OFFICE Microsoft Office Word external document access use-after-free attempt	IPS-SWG
FILE-OFFICE Microsoft Office Word ipdesign.dll ActiveX object access attempt	IPS-SWG
FILE-OFFICE Microsoft Office Word OLMAPI32.dll dll-load exploit attempt	IPS-SWG
FILE-OFFICE Microsoft Office Word remote code execution attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Office Word wwlib.dll out of bounds read attempt	IPS-SWG
FILE-OFFICE Microsoft Outlook remote code execution attempt	IPS-CFW
FILE-OFFICE Microsoft PowerPoint bogus JPEG marker length heap buffer overflow	IPS-SWG
FILE-OFFICE Microsoft Windows common controls MSCOMCTL.OCX buffer overflow attempt	IPS-SWG
FILE-OFFICE Microsoft Windows Outlook remote code execution attempt	IPS-CFWIPS-SWG
FILE-OFFICE Microsoft Word remote code execution attempt	IPS-SWG
FILE-OTHER Microsoft Excel malicious CSV code execution attempt	IPS-SWG
FILE-OTHER Microsoft Visual Studio Code Markdown Preview Enhanced extension command injection attempt	IPS-SWG
FILE-OTHER Microsoft Windows ATMFD font driver malformed OTF file out-of-bounds memory access attempt	IPS-SWG
FILE-OTHER Microsoft Windows CLFS driver privilege escalation attempt	IPS-SWG
FILE-OTHER Microsoft Windows compressed folder tampering attempt	IPS-SWG
FILE-OTHER Microsoft Windows Contact file arbitrary code execution attempt	IPS-CFW
FILE-OTHER Microsoft Windows Defender malformed RAR memory corruption attempt	IPS-CFW
FILE-OTHER Microsoft Windows dismHost.exe dll-load exploit attempt	IPS-SWG
FILE-OTHER Microsoft Windows fontdrvhost SetBlendDesignPositions out of bounds write attempt	IPS-CFW
FILE-OTHER Microsoft Windows GDI memory corruption attempt	IPS-SWG
FILE-OTHER Microsoft Windows GDI32.dll cmap numUVSMappings overflow attempt	IPS-SWG
FILE-OTHER Microsoft Windows malformed .themepack Theme API remote code execution attempt	IPS-CFW
FILE-OTHER Microsoft Windows Media Center link file code execution attempt	IPS-CFW
FILE-OTHER Microsoft Windows Media MIDI file memory corruption attempt	IPS-SWG
FILE-OTHER Microsoft Windows OTF parsing memory corruption attempt	IPS-SWG
FILE-OTHER Microsoft Windows SmartScreen security bypass attempt	IPS-CFWIPS-SWG
FILE-OTHER Microsoft Windows Theme File sensitive disclosure attempt	IPS-CFWIPS-SWG
FILE-OTHER Microsoft Windows Type 1 font stack overflow attempt	IPS-CFWIPS-SWG
FILE-OTHER Microsoft Windows Uniscribe privilege escalation attempt	IPS-SWG
FILE-OTHER Microsoft Windows VCF arbitrary code execution attempt	IPS-CFW
FILE-OTHER Microsoft Word DDEauto code execution attempt	IPS-SWG
INDICATOR-COMPROMISE Microsoft Internet Explorer setAttributeNS ASLR bypass attempt	IPS-SWG
INDICATOR-COMPROMISE Microsoft Office Remote Code Execution Vulnerability	IPS-CFW
INDICATOR-COMPROMISE Microsoft Windows SmartScreen security bypass attempt	IPS-SWG
INDICATOR-COMPROMISE Microsoft Word internal object auto update attempt	IPS-CFWIPS-SWG
INDICATOR-COMPROMISE Microsoft Word internal OLE object update attempt	IPS-SWG
MALWARE-OTHER Generic.Microsoft.Phishing.traffic detected	IPS-SWG
MALWARE-OTHER Microsoft Credential Harvester Exfiltration Detected	IPS-SWG
MALWARE-OTHER Microsoft Credential Harvester Landing Page Detected	IPS-SWG
OS-MOBILE Microsoft Outlook for Android stored cross-site script attempt	IPS-CFW
OS-WINDOWS Microsoft Brokering File System elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft COM for Windows elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Data Sharing dssvc.dll arbitrary file deletion attempt	IPS-CFW
OS-WINDOWS Microsoft Defender denial of service malicious file download attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Defender elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Defender for Endpoint Web Threat Defense denial of service attempt	IPS-NPA
OS-WINDOWS Microsoft DirectX graphics kernel privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft DWM core library escalation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Edge session boundary violation attempt	IPS-CFW
OS-WINDOWS Microsoft Install Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Kernel streaming WOW thunk service driver escalation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Malware Protection Engine type confusion attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Management Console remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Media Foundation remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Office elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft OfficeHub object manager namespace privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Streaming Service Proxy elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Support Diagnostic Tool ms-msdt protocol use attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Support Diagnostic Tool remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Update traffic detected	IPS-SWG
OS-WINDOWS Microsoft Visual Studio git clone argument injection attempt	IPS-CFW
OS-WINDOWS Microsoft Win32k escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Win32K Kernel driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft win32k privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Win32k Windows privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows 10 AcquireCredentialsHandle privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows 10 elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows 10 Win32k elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows 2003 browser election remote heap overflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Accessibility Infrastructure elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows ADDS elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Advanced Local Procedure Call elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Agere Modem Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows ALPC privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Ancillary Function Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Ancillary Function Driver for Winsock privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows anonymous user token impersonation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows api-ms-win-appmodel-runtime dll-load exploit attempt	IPS-SWG
OS-WINDOWS Microsoft Windows AppId driver elevation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Windows AppXSVC privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Audio Compression Manager elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows BitLocker security feature bypass attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows BITS privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Brokering File System elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows CLFS driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows CLFS kernel driver buffer overflow attempt	IPS-SWG
OS-WINDOWS Microsoft Windows CLFS local privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Client Server Run-Time Subsystem privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Client-Server Runtime Subsystem privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Cloud Files Mini Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver information disclosure attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Cloud Files Mini Filter driver privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Cloud Filter privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows CNG Key Isolation Service elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows COM Desktop Broker sandbox escape attempt	IPS-CFW
OS-WINDOWS Microsoft Windows COM elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Common Log File System driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows common log file system driver escalation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows common log file system driver escalation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Common Log File System driver information disclosure attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Common Log File System driver privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Common Log File System elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Common Log File System memory corruption attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Connected Devices Platform service remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Core Messaging elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows CoreMessaging elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows CredSSP elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Cross Device Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows CryptoAPI signed binary with spoofed certificate attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows cryptographic API integer overflow attempt	IPS-SWG
OS-WINDOWS Microsoft Windows cryptographic services code execution attempt	IPS-SWG
OS-WINDOWS Microsoft Windows csc.sys elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows CSRS subsystem elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows CTFMON elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Customer Experience Improvement Program privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Data Sharing Service privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Defender privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Desktop Bridge privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Desktop Window Manager elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Desktop Window Manager escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Desktop Window Manager privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Desktop Windows Manager elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Desktop Windows Manager information disclosure attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows devenum.dll device moniker underflow attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Device Guard bypass attempt	IPS-CFW
OS-WINDOWS Microsoft Windows DHCP client domain search integer underflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows DHCP client Domain Search response memory corruption attempt	IPS-CFW
OS-WINDOWS Microsoft Windows DHCP client Options parsing buffer overflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Digital Media Receiver privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows digital signature spoofing attempt	IPS-SWG
OS-WINDOWS Microsoft Windows DirectX Graphics elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows DirectX Graphics Kernel elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows DirectX kernel driver use after free attempt	IPS-SWG
OS-WINDOWS Microsoft Windows DirectX kernel memory information leak attempt	IPS-SWG
OS-WINDOWS Microsoft Windows DLL Load Configuration Directory out of bounds read attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows DNS elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows dssenh.dll privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows DWM Core elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows DWM Core Library elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows dwmcore elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Dynamic Window Manager privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows EFSRPC bind detected	IPS-CFW
OS-WINDOWS Microsoft Windows Error Reporting elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Error Reporting Service privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Explorer privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Fast FAT file system driver remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows File History Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows File History Service privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows file signature spoofing attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Filter Manager Elevation Of Privilege attempt	IPS-CFW
OS-WINDOWS Microsoft Windows GDI component use after free attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows GDI elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows GDI emf file integer overflow attempt	IPS-SWG
OS-WINDOWS Microsoft Windows GDI+ printer out of bounds write attempt	IPS-CFW
OS-WINDOWS Microsoft Windows gdiplus EMF EmrText out of bounds write attempt	IPS-SWG
OS-WINDOWS Microsoft Windows GetThreadContext kernel memory leak attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Graphics Component elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Graphics Component privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Graphics Component remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows HTTP print provider buffer overflow attempt	IPS-SWG
OS-WINDOWS Microsoft Windows HTTP.sys elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows HTTP.sys information disclosure attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Install Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Installer elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Installer privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Kerberos Proxy Service remote code execution attempt	IPS-NPA
OS-WINDOWS Microsoft Windows Kerberos security feature bypass attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Kernel CSRSS privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows kernel denial of service attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Kernel driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows kernel driver escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows kernel elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows kernel escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Kernel information disclosure attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows kernel privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Kernel Streaming Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Kernel Streaming Service driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Kernel Streaming WOW Thunk Service driver escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows LDAP protocol remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows local privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Local Security Authority Server elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Local Security Authority Subsystem Service information disclosure attempt	IPS-SWG
OS-WINDOWS Microsoft Windows LSAS Service privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows LUAFV driver privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows LUAFV privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows LuafvPostReadWrite privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Mailslot File System elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows mailslot kernel information leak attempt	IPS-CFW
OS-WINDOWS Microsoft Windows malicious LNK file download attempt	IPS-SWG
OS-WINDOWS Microsoft Windows malicious Netlogon NetrServerAuthenticate3 request attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Management Console elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows MapUrlToZone security feature bypass attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Mark-of-the-Web security feature bypass attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Media Center MCL CVE-2016-0185 Code Execution	IPS-CFW
OS-WINDOWS Microsoft Windows Media Center MCL CVE-2016-0185 Code Executionn	IPS-CFW
OS-WINDOWS Microsoft Windows Media Foundation remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Microsoft Defender elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Microsoft Digest Authentication elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Microsoft Streaming Service Proxy elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows MIDI Service Module elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Modern Device Management escalation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows MSHTML Framework security feature bypass attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows MSHTML platform remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows MSHTML Platform spoofing attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows MsMpEng JavaScript garbage collection use after free attempt	IPS-SWG
OS-WINDOWS Microsoft Windows MSMQ denial of service attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Netlogon remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows NetrServerReqChallenge RPC transport sign and seal disabling attempt	IPS-CFW
OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows NT CipFixImageType out of bounds read attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows NT kernel null pointer dereference attempt	IPS-CFW
OS-WINDOWS Microsoft Windows NT MiOffsetToProtos NULL pointer dereference attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows NT MiRelocateImage out of bounds read attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows NT OS Kernel elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows NTFS remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows NTLM elevation of privilege attempt	IPS-CFW
OS-WINDOWS Microsoft Windows NTLM hash disclosure attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows NTLM relay attack attempt	IPS-CFW
OS-WINDOWS Microsoft Windows ntoskrnl elevation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Windows ntoskrnl information disclosure attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Ntoskrnl privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows NtSetCachedSigningLevel Device Guard bypass attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Perception Simulation service remote code execution attempt	IPS-SWG
OS-WINDOWS Microsoft Windows potential Device Guard evasion via Jscript9 scripting engine attempt	IPS-SWG
OS-WINDOWS Microsoft Windows potential malicious Shortcut file download attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Print Spooler elevation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows privilege escalation via path redirection attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Program Compatibility Assistant Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Proxy Driver spoofing attempt	IPS-SWG
OS-WINDOWS Microsoft Windows RDP client memory corruption attempt	IPS-CFW
OS-WINDOWS Microsoft Windows RDP Client remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt	IPS-CFW
OS-WINDOWS Microsoft Windows RDP path redirection remote code execution attempt	IPS-SWG
OS-WINDOWS Microsoft Windows reflective kerberos privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Registry elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Remote Access Connection Manager denial of service attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Remote Access Connection Manager elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Remote Access Connection Manager remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Remote Desktop client DYNVC PDU handling integer overflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Remote Desktop client integer overflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Remote Desktop client PDU parsing integer overflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Remote Desktop client RDPGFX PDU handling integer overflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Remote Desktop client remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Remote Desktop Services elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Remote Desktop Services remote code execution attempt	IPS-NPA
OS-WINDOWS Microsoft Windows Resilient File System elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows ROP gadget locate attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Routing and Remote Access Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows RPCSS privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Runtime remote code execution attempt	IPS-SWG
OS-WINDOWS Microsoft Windows SAM database improper ACLs elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Scripting elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Search Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows search-ms protocol invocation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Secure Boot bypass attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows security feature bypass attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Server LDAP denial of service attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Server network driver remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Server Update Services insecure object deserialization attempt	IPS-NPA
OS-WINDOWS Microsoft Windows Server Update Services potential insecure object deserialization attempt	IPS-NPA
OS-WINDOWS Microsoft Windows SetProcessDeviceMap arbitrary file read attempt	IPS-CFW
OS-WINDOWS Microsoft Windows shell privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB chained compression out of bounds read attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB elevation of privilege attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB kernel heap memory leak attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB NetServerEnum response host format string exploit attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB possible leak of kernel heap memory	IPS-CFW
OS-WINDOWS Microsoft Windows SMB Search andx Search filename size integer underflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB Search Search filename size integer underflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB Search unicode andx Search filename size integer underflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB Search unicode Search filename size integer underflow attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB server denial of service attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB srv2.sys information disclosure attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMB srv2.sys remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows SMBv3 null pointer dereference attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Software Protection Platform elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows SPNEGO Extended Negotiation remote code execution attempt	IPS-CFW
OS-WINDOWS Microsoft Windows StateRepository API elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Storage elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Storage Port Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Storage storesvc elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Storage VSP Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Sysmain Service elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows SystemCollector privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Task Scheduler _SchRpcRegisterTask privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Task Scheduler elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Tasks elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows TCP/IP Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows TCP/IP elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows TCP/IP protocol driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt	IPS-SWG
OS-WINDOWS Microsoft Windows tcpip.sys Driver privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows TDI Translation Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Telephony Server escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Theme code execution attempt	IPS-SWG
OS-WINDOWS Microsoft Windows TPM device driver elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Universal Print Management Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Update Medic service elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Update Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Update Stack elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows User Interface Core elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows User Profile Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows User Profile Service privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows User-Mode Power Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows User-mode Printer Driver privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Virtual Hard Disk Miniport Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows WalletService SetGroup privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Web Proxy Auto-Discovery Protocol elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows WEBDAV remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows win32 kernel subsystem escalation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k driver escalation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k elevation of privilege exploit download attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k escalation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Win32k escalation of privileges attempt	IPS-SWG
OS-WINDOWS Microsoft Windows Win32k font file privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Win32k information disclosure attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k kernel driver privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k local privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows win32k NtGdiCreateDIBitmapInternal memory corruption attempt	IPS-CFW
OS-WINDOWS Microsoft Windows win32k NtUserSetImeInfoEx privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows win32k.sys driver local privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows win32k.sys privilege escalation attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Win32k.sys TrueType font out of bounds write attempt	IPS-CFW
OS-WINDOWS Microsoft Windows Win32kbase.sys elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows Common Log File System Driver elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows DWM Core Library elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows Installer elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows Kernel elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows Media elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows Network Connections Service elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Windows Win32k elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Winlogon elevation of privilege attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft Windows Winsock local privilege escalation attempt	IPS-SWG
OS-WINDOWS Microsoft Windows WOW Thunk Service Driver elevation of privilege attempt	IPS-SWG
OS-WINDOWS Microsoft Word remote code execution attempt	IPS-CFWIPS-SWG
OS-WINDOWS Microsoft XmlDocument privilege escalation attempt	IPS-CFW
POLICY-OTHER Microsoft Exchange Web Services brute force login attempt	IPS-SWG
POLICY-OTHER Microsoft Sharepoint invalid WS-Trust request	IPS-NPA
POLICY-OTHER Microsoft Windows Admin Center potential remote code execution attempt	IPS-NPA
POLICY-OTHER Microsoft Windows HTML Application download detected	IPS-SWG
POLICY-OTHER Microsoft Windows RDP Memory corruption attempt	IPS-CFW
PROTOCOL-IMAP Microsoft Outlook information disclosure attempt	IPS-CFW
PROTOCOL-IMAP Microsoft sizeddip section integer overflow	IPS-CFW
SERVER-MAIL Microsoft Exchange remote code execution attempt	IPS-NPA
SERVER-MAIL Microsoft Exchange Server arbitrary file write attempt	IPS-NPA
SERVER-MAIL Microsoft Exchange Server certificate leak attempt	IPS-NPA
SERVER-MAIL Microsoft Exchange Server remote PowerShell session type confusion attempt	IPS-NPA
SERVER-OTHER Microsoft Exchange Server DLPUtils remote code execution attempt	IPS-NPA
SERVER-OTHER Microsoft Exchange Server privilege escalation attempted	IPS-NPA
SERVER-OTHER Microsoft Exchange Server remote code execution attempt	IPS-NPA
SERVER-OTHER Microsoft Sharepoint Server remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft .NET Framework information disclosure attempt	IPS-NPA
SERVER-WEBAPP Microsoft Azure Fabric Explorer cross site scripting attempt	IPS-SWG
SERVER-WEBAPP Microsoft Configuration Manager SQL injection attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Control Panel remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Control Panel static viewstate key use attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange DLP policy template code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange MAPI arbitrary file write attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange MeetingHandler remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange ProxyToken information disclosure attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server arbitrary file write attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server DlpUtils remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server information disclosure attempted	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server MailboxExport arbitrary file write attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange server security feature bypass attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server server side request forgery attempt	IPS-NPA
SERVER-WEBAPP Microsoft Exchange Server spoofing attempted	IPS-NPA
SERVER-WEBAPP Microsoft IIS ScStoragePathFromUrl function buffer overflow attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint authenticated remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft Sharepoint DataFormWebPart remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint elevation of privilege attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint EntityInstanceIdEncoder remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint file upload information disclosure attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint machinekey information disclosure attempt	IPS-NPA
SERVER-WEBAPP Microsoft Sharepoint malicious deserialization attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint OAuth authentication bypass attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint potential deserialization attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint Server authenticated remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint Server remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint Server XML external entity injection attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint TypeConverter remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint WebControls AdRotator NTLM relay attempt	IPS-NPA
SERVER-WEBAPP Microsoft SharePoint Workflow XOML injection attempt	IPS-NPA
SERVER-WEBAPP Microsoft Skype for Business server side request forgery attempt	IPS-NPA
SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt	IPS-NPA
SERVER-WEBAPP Microsoft SSO Plugin for Jira and Confluence authentication bypass attempt	IPS-NPA
SERVER-WEBAPP Microsoft WebDeploy external inbound deploy request attempt	IPS-NPA
SERVER-WEBAPP Microsoft WebDeploy insecure deserialization attempt	IPS-NPA
SERVER-WEBAPP Microsoft Windows .NET API XML unsafe deserialization attempt	IPS-NPA
SERVER-WEBAPP Microsoft Windows CreateProcess cmd.exe command injection attempt	IPS-NPA

Related families

Overlay Marte