Windows Update activating Suricata alert (ET SHELLCODE Common 0a0a0a0a Heap Spray String)

[luquinhasdainfra]

Hi, hope you're having a wordeful day

Today (03/11/23), my Suricata started to get a lot of alerts about a shell exploitation.

The fact is, half of the IPs are from Microsoft / Azure networks and the other half are from CDN that negotiates with Microsoft.

Another curious fact is that the destination IP is my WSUS server, so maybe they are the updates that are being syncrhonized by my server.

What do you guys think? That's a false positive from the Windows Update Server or am i really under attack?

Best Whises.

[bmeeks]

99% chance it is a false positive. A quick Google search for that rule alert description turns up a lot of other false positive posts going back over several years.