Signature ID = 6043

[mhanson2004]

Signature update S862 that included Signature ID 6043 Microsoft.HTTP.Sys Remote Code Execution was just released. We are seeing a large amount of alerts on this signature with the alerts coming from machines on our network with the traffic  heading off of network. No destination or victim addresses are noted just 0.0.0.0

Anyone else seeing similar activity?

Thank you.

Mike

[JonPBerbee]

I've noticed this event trigger 8 times on one of my customers IPS devices in the past 24 hours. With the exception of the Summary alert, though, all other alerts had source/destination IPs and was traffic coming in from the Internet.

From what you describe above it sounds to me like you're just seeing Summary alerts. I'm not sure why you wouldn't see the alerts that have source/destination unless there is a filter that disables the alerting for certain RR's.

Jon.