SID 1:41191

Report a false positive

Rule Category

FILE-FLASH -- Snort has detected suspicious traffic via the Adobe Flash Player. Flash is a common target of code execution, overflow, DoS, and memory corruption attacks in particular, via swifs, action scripts, etc. Many networks block Flash altogether; the application will be deprecated in 2020.

Alert Message

FILE-FLASH Adobe Flash SMTP MIME attachment detected

Rule Explanation

This rule looks for the magic value associated with Flash files in SMTP file transfers.

What To Look For

This rule fires when a Flash file is detected being sent over SMTP.

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This rule will alert whenever a Flash file is detected being transferred over SMTP.

Contributors

Cisco Talos

Rule Groups

MITRE::ATT&CK Framework::Enterprise::Execution::User Execution::Malicious File

CVE

CVE-2012-5677 CVE-2015-0303 CVE-2015-0310 CVE-2015-3042 CVE-2015-3124 CVE-2016-1010 CVE-2016-4228 CVE-2016-4229 CVE-2017-3114

Additional Links

en.wikipedia.org/wiki/SWF

Rule Vulnerability

N/A

Not Applicable

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2012-5677
 Loading description
CVE-2015-0303
 Loading description
CVE-2015-0310
 Loading description
CVE-2015-3042
 Loading description
CVE-2015-3124
 Loading description
CVE-2016-1010
 Loading description
CVE-2016-4228
 Loading description
CVE-2016-4229
 Loading description
CVE-2017-3114
 Loading description

MITRE ATT&CK Framework

Tactic: Command and Control

Technique: Custom Command and Control Protocol

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org