NTFS Vulnerability Exploitation

Title: NTFS Vulnerability Exploitation
Status: test
Description:This the exploitation of a NTFS vulnerability as reported without many details via Twitter
References:
  -https://twitter.com/jonasLyk/status/1347900440000811010
  -https://twitter.com/wdormann/status/1347958161609809921
  -https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/
Author: Florian Roth (Nextron Systems)
Date: 2021-01-11
modified:2022-12-25
Tags:

• -'attack.impact'
• -'attack.t1499.001'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Ntfs'
    EventID: '55'
    Origin: 'File System Driver'
    Description|contains|all:
      -'contains a corrupted file record'
      -'The name of the file is "\"'

  condition:selection
Falsepositives:
  -Unlikely
Level: high