MS08-067 In The Wild
Summary: Sourcefire's VRT analyzed customer PCAPs that triggered MS08-067 rules and confirmed them as true positives after analyst Lurene Grenier dumped the RPC stub data and found a seven-byte XOR decoding routine at the start of the shellcode. The customer, a large French manufacturing company, had seen an outbreak of the malicious traffic across its worldwide network that morning, but the attacks could not penetrate its core network in France because the MS08-067 Sourcefire rules were running in drop mode.
What's compelling: The customer's IPS blocked every attack attempt on the network segment where the rules were enabled in drop mode, while the same malicious traffic spread across the rest of its worldwide network that morning - the outcome turned on where the rules were actually set to block rather than alert.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026