Think you have a false positive on this rule?

Sid 1-49800

Message

BROWSER-IE Microsoft Internet Explorer MHTML XXE external entity attempt

Summary

This event is generated when Microsoft Internet Explorer MHTML XXE external entity attempted.

Impact

Attempted User Privilege Gain

Detailed information

Affected systems

Ease of attack

False positives

False negatives

Corrective action

Contributors

  • Cisco Talos Intelligence Group

Additional References

  • hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-v11-XML-EXTERNAL-ENTITY-INJECTION-0DAY.txt