Detecting CVE-2022-26937 with Zeek

This month, [**Microsoft announced a vulnerability in NFS**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26937). The exploit lies in how an attacker can force a victim NFS server to request an address from the attacker’s fake NFS server. The address returned will overflow memory on the victim NFS server and cause a crash. Through [**Microsoft’s MAPP program**](https://www.microsoft.com/en-us/msrc/mapp), [Corelight Labs](https://corelight.com/company/corelight-labs/recent-research) reviewed a proof-of-concept exploit for this vulnerability and wrote a [**Zeek®**](https://zeek.org/)\-based detection for it. 

Get the details: [https://corelight.com/blog/detecting-cve-2022-26937-with-zeek](https://corelight.com/blog/detecting-cve-2022-26937-with-zeek)

cve cve-2022-26937 cybersecurity zeek