NTFS Vulnerability Exploitation (Corrupted File Record)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•28

This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.