{"name": "kev overview", "versions": {"navigator": "4.8.0", "layer": "4.4", "attack": "15.1"}, "sorting": 3, "description": "kev heatmap overview of kev mappings, scores are the number of associated entries", "domain": "enterprise-attack", "techniques": [{"techniqueID": "T1202", "score": 9, "comment": " Related to: \n \u2022CVE-2022-29464\n\u2022CVE-2023-40044\n\u2022CVE-2019-3396\n\u2022CVE-2019-3398\n\u2022CVE-2013-0629\n\u2022CVE-2023-32315\n\u2022CVE-2024-24919\n\u2022CVE-2018-0296\n\u2022CVE-2020-3452", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-40044"}, {"name": "comment", "value": "Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0629"}, {"name": "comment", "value": "This is an exploitation of a public-facing server due to password misconfiguration. Exploitation allows attackers to access restricted directories"}, {"divider": true}, {"name": "control", "value": "CVE-2018-0296"}, {"name": "comment", "value": "CVE-2018-0296 is a critical vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to perform directory traversal attacks and access sensitive system information."}, {"divider": true}, {"name": "control", "value": "CVE-2020-3452"}, {"name": "comment", "value": "CVE-2020-3452 is a vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system."}, {"divider": true}, {"name": "control", "value": "CVE-2019-3396"}, {"name": "comment", "value": "CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-3398"}, {"name": "comment", "value": "CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center that allows an authenticated attacker to write files to arbitrary locations, potentially leading to remote code execution"}, {"divider": true}, {"name": "control", "value": "CVE-2023-32315"}, {"name": "comment", "value": "CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.  "}, {"divider": true}, {"name": "control", "value": "CVE-2024-24919"}, {"name": "comment", "value": "CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-29464"}, {"name": "comment", "value": "CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency."}]}, {"techniqueID": "T1071.002", "score": 1, "comment": " Related to: \n \u2022CVE-2023-40044", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-40044"}, {"name": "comment", "value": "Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands."}]}, {"techniqueID": "T1059", "score": 105, "comment": " Related to: \n \u2022CVE-2021-22205\n\u2022CVE-2021-27101\n\u2022CVE-2021-1497\n\u2022CVE-2019-11580\n\u2022CVE-2021-42013\n\u2022CVE-2019-11510\n\u2022CVE-2018-6789\n\u2022CVE-2021-45046\n\u2022CVE-2021-41773\n\u2022CVE-2024-4879\n\u2022CVE-2024-34102\n\u2022CVE-2020-25506\n\u2022CVE-2022-22965\n\u2022CVE-2021-26084\n\u2022CVE-2022-39197\n\u2022CVE-2024-21887\n\u2022CVE-2024-20359\n\u2022CVE-2023-34362\n\u2022CVE-2021-22893\n\u2022CVE-2021-22204\n\u2022CVE-2023-20109\n\u2022CVE-2023-36845\n\u2022CVE-2023-22952\n\u2022CVE-2018-11776\n\u2022CVE-2022-23131\n\u2022CVE-2024-4671\n\u2022CVE-2020-29557\n\u2022CVE-2023-20273\n\u2022CVE-2020-15505\n\u2022CVE-2021-1498\n\u2022CVE-2021-42321\n\u2022CVE-2022-22047\n\u2022CVE-2020-3580\n\u2022CVE-2024-5217\n\u2022CVE-2021-27102\n\u2022CVE-2021-42258\n\u2022CVE-2021-3129\n\u2022CVE-2021-31166\n\u2022CVE-2020-17530\n\u2022CVE-2022-26258\n\u2022CVE-2019-19781\n\u2022CVE-2023-36851\n\u2022CVE-2017-11882\n\u2022CVE-2017-5638\n\u2022CVE-2019-3398\n\u2022CVE-2023-38035\n\u2022CVE-2024-4947\n\u2022CVE-2022-35914\n\u2022CVE-2022-41125\n\u2022CVE-2021-22005\n\u2022CVE-2021-35394\n\u2022CVE-2022-29303\n\u2022CVE-2023-27350\n\u2022CVE-2022-26500\n\u2022CVE-2022-35405\n\u2022CVE-2020-5902\n\u2022CVE-2022-34713\n\u2022CVE-2023-20867\n\u2022CVE-2016-4437\n\u2022CVE-2023-7101\n\u2022CVE-2022-24521\n\u2022CVE-2024-20399\n\u2022CVE-2019-13608\n\u2022CVE-2023-2868\n\u2022CVE-2021-42237\n\u2022CVE-2021-21972\n\u2022CVE-2017-9805\n\u2022CVE-2024-27198\n\u2022CVE-2024-4577\n\u2022CVE-2022-21999\n\u2022CVE-2021-22986\n\u2022CVE-2023-43770\n\u2022CVE-2017-9822\n\u2022CVE-2023-36847\n\u2022CVE-2019-11634\n\u2022CVE-2021-35464\n\u2022CVE-2023-48788\n\u2022CVE-2023-41179\n\u2022CVE-2022-26501\n\u2022CVE-2023-28252\n\u2022CVE-2021-45382\n\u2022CVE-2020-0787\n\u2022CVE-2019-17558\n\u2022CVE-2023-36846\n\u2022CVE-2023-20887\n\u2022CVE-2022-37969\n\u2022CVE-2017-6742\n\u2022CVE-2021-22900\n\u2022CVE-2010-2883\n\u2022CVE-2023-40044\n\u2022CVE-2023-26359\n\u2022CVE-2018-7600\n\u2022CVE-2020-8515\n\u2022CVE-2022-42948\n\u2022CVE-2023-33246\n\u2022CVE-2022-21971\n\u2022CVE-2024-4761\n\u2022CVE-2023-35081\n\u2022CVE-2021-22894\n\u2022CVE-2022-36804\n\u2022CVE-2024-26169\n\u2022CVE-2022-22947\n\u2022CVE-2023-22515\n\u2022CVE-2022-1040\n\u2022CVE-2021-27104", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-36804"}, {"name": "comment", "value": "This vulnerability allows remote attackers with read permissions to a public or private Bitbucket repositories to execute arbitrary code by sending a malicious HTTP request."}, {"divider": true}, {"name": "control", "value": "CVE-2010-2883"}, {"name": "comment", "value": "This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26359"}, {"name": "comment", "value": "This vulnerability is utilized by exploiting a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21972"}, {"name": "comment", "value": " CVE-2021-21972 is a RCE vulnerability affecting VMware vCenter servers. An attacker with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server."}, {"divider": true}, {"name": "control", "value": "CVE-2020-0787"}, {"name": "comment", "value": "CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2017-11882"}, {"name": "comment", "value": "CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office.  The vulnerability is ideal for phasing campaigns, and it enables RCE on vulnerable systems."}, {"divider": true}, {"name": "control", "value": "CVE-2020-15505"}, {"name": "comment", "value": "CVE-2020-15505 is an RCE vulnerability in MobileIron Core & Connector that allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors.\n\nMultiple APTs have been observed exploiting this vulnerability to gain unauthorized access."}, {"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902\u2014an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)\u2014to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, \u201cexecute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.\u201d - CISA Advisory"}, {"divider": true}, {"name": "control", "value": "CVE-2019-11510"}, {"name": "comment", "value": "CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-19781"}, {"name": "comment", "value": "CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC). "}, {"divider": true}, {"name": "control", "value": "CVE-2016-4437"}, {"name": "comment", "value": "CVE-2016-4437 is a code execution vulnerability in Apache Shiro that allows remote attackers to execute code or bypass access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature."}, {"divider": true}, {"name": "control", "value": "CVE-2021-42013"}, {"name": "comment", "value": "CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied,\" these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2021-41773"}, {"name": "comment", "value": "CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied,\" these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2018-11776"}, {"name": "comment", "value": "CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. "}, {"divider": true}, {"name": "control", "value": "CVE-2017-5638"}, {"name": "comment", "value": "CVE-2017-5638  is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-17530"}, {"name": "comment", "value": "CVE-2020-17530 is a remote code execution vulnerability in Apache Struts versions 2.0.0 - 2.5.25 allows an attacker to execute code via forced Object Graph Navigational Language (OGNL). "}, {"divider": true}, {"name": "control", "value": "CVE-2019-17558"}, {"name": "comment", "value": "CVE-2019-17558 is a vulnerability in Apache Solr that allows for Remote Code Execution (RCE) through the VelocityResponseWriter. "}, {"divider": true}, {"name": "control", "value": "CVE-2017-9805"}, {"name": "comment", "value": "CVE-2017-9805 is a deserialization vulnerability in the Apache Struts REST Plugin that could allow an attacker to execute arbitrary commands remotely on the affected systems by sending a specially crafted web request to the application."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27104"}, {"name": "comment", "value": "CVE-2021-27104 is an operating system command injection vulnerability in Accellion File Transfer Appliance in that allows an adversary to execute commands by sending a specially crafted POST request to the product's administrative endpoint."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27102"}, {"name": "comment", "value": "CVE-2021-27102 is an operating system command execution vulnerability in Accellion File Transfer Appliance that allows an adversary to execute arbitrary commands via a local web service call."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27101"}, {"name": "comment", "value": "CVE-2021-27101 is a SQL injection vulnerability in Accellion File Transfer Appliance that allows an adversary to execute SQL commands."}, {"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "Vulnerability in Citrix Receiver for Windows may allows attacker to gain read/write access to the client's local drives, potentially enabling code execution on the client device, such as deploying ransomware"}, {"divider": true}, {"name": "control", "value": "CVE-2019-13608"}, {"name": "comment", "value": "CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-1498"}, {"name": "comment", "value": "CVE-2021-1498 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device"}, {"divider": true}, {"name": "control", "value": "CVE-2021-1497"}, {"name": "comment", "value": "CVE-2021-1497 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Installer Virtual Machine. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device"}, {"divider": true}, {"name": "control", "value": "CVE-2024-34102"}, {"name": "comment", "value": "This vulnerability is exploited by sending a crafted XML document that references external entities with the likely goal of accessing local data."}, {"divider": true}, {"name": "control", "value": "CVE-2020-3580"}, {"name": "comment", "value": "CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface\nor access sensitive browser-based information. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-42258"}, {"name": "comment", "value": "CVE-2021-42258 is a SQL injection vulnerability in BillQuick Web Suite that allows  attackers to execute arbitrary SQL commands on the database server"}, {"divider": true}, {"name": "control", "value": "CVE-2019-11580"}, {"name": "comment", "value": "CVE-2019-11580 is a critical vulnerability affecting Atlassian Crowd and Crowd Data Center that allows attackers remote code execution to send specially crafted requests to install malicious plugins on vulnerable Crowd instances."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26084"}, {"name": "comment", "value": "CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances"}, {"divider": true}, {"name": "control", "value": "CVE-2019-3398"}, {"name": "comment", "value": "CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center that allows an authenticated attacker to write files to arbitrary locations, potentially leading to remote code execution"}, {"divider": true}, {"name": "control", "value": "CVE-2021-35464"}, {"name": "comment", "value": "CVE-2021-35464, a pre-auth remote code execution (RCE) vulnerability in ForgeRock Access Manager identity and access management software. ForgeRock front-ends web applications and remote access solutions in many enterprises."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22986"}, {"name": "comment", "value": "CVE-2021-22986 is a remote command execution vulnerability occurring on the iControl REST interface. Impact reported by the F5 security advisory \"This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. \""}, {"divider": true}, {"name": "control", "value": "CVE-2018-6789"}, {"name": "comment", "value": "CVE-2018-6789 is a vulnerability in Exim, an open-source mail transfer agent. This vulnerability, identified as an off-by-one buffer overflow, allows attackers to execute arbitrary code remotely by sending specially crafted messages to the SMTP listener. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-22205"}, {"name": "comment", "value": "CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-7600"}, {"name": "comment", "value": "CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal\u2019s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2020-8515"}, {"name": "comment", "value": "CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use."}, {"divider": true}, {"name": "control", "value": "CVE-2017-9822"}, {"name": "comment", "value": "CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications"}, {"divider": true}, {"name": "control", "value": "CVE-2020-25506"}, {"name": "comment", "value": "CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2020-29557"}, {"name": "comment", "value": "CVE-2020-29557 is a buffer overflow vulnerability  in the web interface allows attackers to achieve pre-authentication remote code execution. Unidentified threat actors are reported to have been actively exploiting it to co-opt them to a Mirai-variant botnet used for carrying out DDoS attacks, merely two days after its public disclosure. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-26169"}, {"name": "comment", "value": "This vulnerability is a zero-day exploit that \"manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WerFault.exe and set the \"Debugger\" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges.\" This vulnerability has been exploited by the Black Basta ransomware group."}, {"divider": true}, {"name": "control", "value": "CVE-2021-3129"}, {"name": "comment", "value": "This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-27350"}, {"name": "comment", "value": "CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines."}, {"divider": true}, {"name": "control", "value": "CVE-2022-35405"}, {"name": "comment", "value": "CVE-2022-35405 is an unauthenticated remote code execution vulnerability as a result of deserialization."}, {"divider": true}, {"name": "control", "value": "CVE-2023-40044"}, {"name": "comment", "value": "Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands."}, {"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2023-48788"}, {"name": "comment", "value": "This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2017-6742"}, {"name": "comment", "value": "CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC\u2019s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor."}, {"divider": true}, {"name": "control", "value": "CVE-2023-2868"}, {"name": "comment", "value": "CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions."}, {"divider": true}, {"name": "control", "value": "CVE-2021-42237"}, {"name": "comment", "value": "CVE 2021-42237related to a remote code execution vulnerability through insecure deserialization. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-45046"}, {"name": "comment", "value": "CVE 2021-45046 is a Log4J-related vulnerability that could enable enables an attacker to cause Remote Code Execution or other effects in certain non-default configurations. This specific vulnerability has been reported to have been leveraged in cryptomining and ransomware operations. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-20399"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has access to administrator credentials. The adversary leverages these credentials to execute arbitrary commands using root privileges. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-20109"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability has been identified as being exploited in the wild by Chinese adversary groups. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-20359"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated, local attacker in order to execute arbitrary code with root-level privileges by copying a crafted file to the disk0: file system. This is possible due to improper validation of a file when it is read from system flash memory. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-22005"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who can access the vCenter Server over the network. The adversary uploads a crafted file to the server's analytics service via port 443, exploiting the file upload vulnerability. This results in remote code execution on the host. Threat actors have been observed leveraging this vulnerability, identified as CVE-2021-22005, using code released by security researcher Jang, to gain unauthorized access to vCenter servers."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22900"}, {"name": "comment", "value": "This vulnerability is exploited through multiple unrestricted uploads. Adversaries with authenticated administrator privileges leverage this vulnerability to perform unauthorized file writes on the system via a maliciously crafted archive upload within the administrator web interface in Pulse Connect Secure."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22894"}, {"name": "comment", "value": "This vulnerability is exploited through a buffer overflow weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution with root privileges on the Pulse Connect Secure gateway by manipulating input buffers."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22893"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments."}, {"divider": true}, {"name": "control", "value": "CVE-2024-21887"}, {"name": "comment", "value": "This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36851"}, {"name": "comment", "value": "This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on SRX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `webauth_operation.php` endpoint, which does not require authentication. This manipulation allows attackers to cause limited impact to the file system integrity, potentially enabling further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36847"}, {"name": "comment", "value": "This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on EX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `installAppPackage.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system and enabling attackers to chain this vulnerability with others, potentially leading to further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36846"}, {"name": "comment", "value": "This vulnerability is exploited through a Missing Authentication for Critical Function weakness. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `user.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files, enabling attackers to chain this vulnerability with others, potentially leading to unauthenticated remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36845"}, {"name": "comment", "value": "This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web interface of Juniper Networks Junos OS, affecting EX Series switches and SRX Series firewalls. Attackers leverage this vulnerability to gain initial access by crafting a request that sets the PHPRC variable, thereby altering the PHP execution environment. This manipulation enables the injection and execution of arbitrary code. By exploiting the auto_prepend_file and allow_url_include PHP features, attackers can include a base64 encoded PHP payload using the data:// wrapper. This method allows them to execute code within a confined FreeBSD jail environment, with the potential to escalate privileges by stealing authentication tokens from a user logged into the J-Web application, ultimately enabling unauthorized SSH access with elevated privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2023-35081"}, {"name": "comment", "value": "This vulnerability is exploited through a path traversal flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging authenticated administrative access to remotely write arbitrary files onto the server. This enables them to deploy additional payloads, potentially granting further access and compromising the system. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22515"}, {"name": "comment", "value": "This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-20273"}, {"name": "comment", "value": "This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system\n\nThis CVE was exploited after the adversary exploited CVE-2023-20198."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4577"}, {"name": "comment", "value": "CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4671"}, {"name": "comment", "value": "CVE-2024-4671 is a use-after-free vulnerability where an adversary can perform a sandbox escape via a maliciously-crafted HTML page."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4761"}, {"name": "comment", "value": "CVE-2024-4761 is an out of bounds write vulnerability that allows a remote attacker to perform an out of bounds memory write via a crafted HTML page. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-4879"}, {"name": "comment", "value": "CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4947"}, {"name": "comment", "value": "CVE-2024-4947 is a type confusion vulnerability in Chrome's V8 JavaScript engine.\n\nAdversaries have been observed exploiting this vulnerability by hosting a web-based game on a site that triggered the vulnerability and executed arbitrary code. \n\nAdversaries promoted the game on social media and through emails."}, {"divider": true}, {"name": "control", "value": "CVE-2024-5217"}, {"name": "comment", "value": "CVE-2024-5217 is an input validation vulnerability that could enable an unauthenticated user to remotely execute code within the context of the Now Platform due to incomplete input validation in a GlideExpression Script."}, {"divider": true}, {"name": "control", "value": "CVE-2022-29303"}, {"name": "comment", "value": "CVE-2022-29303 is a command injection vulnerability within a PHP component in the product's web server. \nReports indicate that the vulnerability have been exploited by operators of Mirai botnet malware. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-33246"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware."}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:"}, {"divider": true}, {"name": "control", "value": "CVE-2022-21999"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.\n\nThe exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\\Windows\\System32\\spool\\drivers\\x64\\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.\n\nThe vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns."}, {"divider": true}, {"name": "control", "value": "CVE-2022-37969"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41125"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22047"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24521"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system."}, {"divider": true}, {"name": "control", "value": "CVE-2024-27198"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by an unauthenticated, remote adversary via an alternative path issue in the web component allowing attackers to perform admin actions and achieve remote code execution. To exploit this vulnerability, attackers need to generate an unauthenticated 404 HTTP response, pass the HTTP query string \u201c?jsp=/app/rest/server\u201d, and append \u201c;.jsp\u201d to the HTTP path parameter."}, {"divider": true}, {"name": "control", "value": "CVE-2022-23131"}, {"name": "comment", "value": "This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-1040"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine. \n\nIt was actively exploited by Chinese state-sponsored APT groups, including \"Drifting Cloud,\" to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.\n\nThis vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named \"Pacific Rim.\" This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object (\"libsophos.so\"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.\n\nThis vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.\n\nThe attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely."}, {"divider": true}, {"name": "control", "value": "CVE-2023-43770"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system. \n\nThe Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services."}, {"divider": true}, {"name": "control", "value": "CVE-2022-39197"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker to execute HTML on the Cobalt Strike team server. To exploit this vulnerability, an attacker would inspect a Cobalt Strike payload and modify the username field within the payload to be malformed. This manipulation enables the attacker to execute arbitrary code by setting a malformed username in the Beacon configuration.\n\nIn a documented cybersecurity incident, a Chinese threat actor leveraged a modified version of Cobalt Strike, known as \"Cobalt Strike Cat,\" which included a patch for CVE-2022-39197. This version was used to establish communication channels with victim systems, perform evasive post-exploitation activities, and maintain persistence. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-41179"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who has obtained administrative console access on the target system. Successful exploitation of the flaw could allow an attacker to manipulate the component to execute arbitrary commands on an affected installation. This vulnerability has been exploited in the wild. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-7101"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker by passing unvalidated input from a file into a string-type \"eval\". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. After successful exploitation, the attacker gains the ability to perform remote code execution. This vulnerability has been targeted by Chinese hackers who exploited the vulnerability in Spreadsheet::ParseExcel to compromise appliances. In collaboration with cybersecurity firm Mandiant, Barracuda assesses that the threat actor behind the attacks is UNC4841, who leveraged the flaw to deploy \u2018SeaSpy\u2019 and \u2018Saltwater\u2019 malware."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-35914"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker via /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2, which allows PHP code injection.\n\nin the wild exploitation details have not been publicly released for this vulnerability"}, {"divider": true}, {"name": "control", "value": "CVE-2022-22965"}, {"name": "comment", "value": "This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the \"/tmp\" directory and changing its permissions to make it executable using \"chmod.\" The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures."}, {"divider": true}, {"name": "control", "value": "CVE-2022-42948"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker. The vulnerability is caused by improper escaping of HTML tags in Swing components. This flaw allows the attacker to inject crafted HTML code, enabling them to execute code within the Cobalt Strike UI. Exploitation can occur through a graphical file explorer menu, allowing attackers to perform unauthorized operations on the administrative interface."}, {"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22204"}, {"name": "comment", "value": "The vulnerability is exploited by a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to improper input validation when parsing DjVu files in ExifTool. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26500"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.\n\nThis vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26501"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.\n\nThis vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection."}, {"divider": true}, {"name": "control", "value": "CVE-2021-45382"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and  IZ1H9 to cause a distributed denial of service attack. \n\nIn the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.\n\nIn the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called \"ddns.sh.\" This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26258"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an adversary via HTTP POST to get set ccp. The exploit targets a command injection vulnerability in the /lan.asp component. The component does not successfully sanitize the value of the HTTP parameter DeviceName, which in turn can lead to arbitrary command execution. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called MooBot to cause a distributed denial of service attack. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-34713"}, {"name": "comment", "value": "This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-42321"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has gained authentication to the Exchange Server and exploited validation issues in command-let arguments. This gives the adversary access to perform remote code execution on the server. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-20867"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20887"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated actor to gain remote code execution via a command injection attack. This vulnerability has been exploited in the wild; however, technical details have not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-22947"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-31166"}, {"name": "comment", "value": "This memory corruption vulnerability is exploited by a remote, unauthenticated attacker via crafted HTTP packets to a server that uses http.sys to process packets. Adversaries may leverage this vulnerability to execute malicious code on the OS kernel. This vulnerability has a proof of concept validating that it can be wormable. However, exploitations in the wild linking to this type of impact have not been published. \n\nThe North Korean state-backed hacker group known as the Lazarus Group has been attributed to leveraging this vulnerability in their attacks to gain initial access to Windows IIS servers. Once initial access is gained, they have exploited the vulnerable system to perform data theft, disrupt services, propagate malware, or conduct espionage or surveillance. \n\n**team review - AttackerKB links Command and Scripting to this vulnerability, but I have not found any threat reports linking this impact to an actual attack. The only \"in the wild\" report I found was by SecureBlink linking it to the Lazarus Group to gain initial access. Unsure what primary impact we can link to here. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-21971"}, {"name": "comment", "value": "This vulnerability is exploited when an authenticated user is convinced by an attacker to download and open a specially crafted file from a website, which grants the attacker access to the victim's computer. No articles have been released to the public showing that this vulnerability has been executed in the wild or provides any information on how an exploitation is carried out. "}]}, {"techniqueID": "T1005", "score": 29, "comment": " Related to: \n \u2022CVE-2021-27102\n\u2022CVE-2019-1653\n\u2022CVE-2021-27101\n\u2022CVE-2024-24919\n\u2022CVE-2018-0296\n\u2022CVE-2019-13608\n\u2022CVE-2021-29256\n\u2022CVE-2017-5638\n\u2022CVE-2021-26085\n\u2022CVE-2020-8195\n\u2022CVE-2020-8193\n\u2022CVE-2024-34102\n\u2022CVE-2021-27103\n\u2022CVE-2017-11292\n\u2022CVE-2023-38831\n\u2022CVE-2023-4966\n\u2022CVE-2023-49103\n\u2022CVE-2023-34362\n\u2022CVE-2020-8196\n\u2022CVE-2021-26855\n\u2022CVE-2024-23692\n\u2022CVE-2019-5591\n\u2022CVE-2019-11634\n\u2022CVE-2020-5902\n\u2022CVE-2024-4978\n\u2022CVE-2023-36884\n\u2022CVE-2013-0629\n\u2022CVE-2021-27104\n\u2022CVE-2020-3452", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-26085"}, {"name": "comment", "value": "This vulnerability allows viewing of restricted resources via a pre-authorization arbitrary file read vulnerability."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0629"}, {"name": "comment", "value": "This is an exploitation of a public-facing server due to password misconfiguration. Exploitation allows attackers to access restricted directories"}, {"divider": true}, {"name": "control", "value": "CVE-2021-29256"}, {"name": "comment", "value": "This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-26855"}, {"name": "comment", "value": "CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information."}, {"divider": true}, {"name": "control", "value": "CVE-2019-1653"}, {"name": "comment", "value": "CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices."}, {"divider": true}, {"name": "control", "value": "CVE-2017-5638"}, {"name": "comment", "value": "CVE-2017-5638  is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-27104"}, {"name": "comment", "value": "CVE-2021-27104 is an operating system command injection vulnerability in Accellion File Transfer Appliance in that allows an adversary to execute commands by sending a specially crafted POST request to the product's administrative endpoint."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27101"}, {"name": "comment", "value": "CVE-2021-27101 is a SQL injection vulnerability in Accellion File Transfer Appliance that allows an adversary to execute SQL commands."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27103"}, {"name": "comment", "value": "CVE-2021-27103 is a server-side request forgery vulnerability in Accellion File Transfer Appliance in Accellion that allows an adversary to manipulate server requests via a crafted POST request."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27102"}, {"name": "comment", "value": "CVE-2021-27102 is an operating system command execution vulnerability in Accellion File Transfer Appliance that allows an adversary to execute arbitrary commands via a local web service call."}, {"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows "}, {"divider": true}, {"name": "control", "value": "CVE-2019-13608"}, {"name": "comment", "value": "CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.\n"}, {"divider": true}, {"name": "control", "value": "CVE-2018-0296"}, {"name": "comment", "value": "CVE-2018-0296 is a critical vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to perform directory traversal attacks and access sensitive system information."}, {"divider": true}, {"name": "control", "value": "CVE-2024-34102"}, {"name": "comment", "value": "This vulnerability is exploited by sending a crafted XML document that references external entities with the likely goal of accessing local data."}, {"divider": true}, {"name": "control", "value": "CVE-2020-3452"}, {"name": "comment", "value": "CVE-2020-3452 is a vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system."}, {"divider": true}, {"name": "control", "value": "CVE-2017-11292"}, {"name": "comment", "value": "This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems."}, {"divider": true}, {"name": "control", "value": "CVE-2019-5591"}, {"name": "comment", "value": "CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server."}, {"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902\u2014an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)\u2014to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, \u201cexecute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.\u201d - CISA Advisory"}, {"divider": true}, {"name": "control", "value": "CVE-2020-8193"}, {"name": "comment", "value": "CVE-2020-8193 is an Authorization Bypass vulnerability in Citrix ADC, Gateway, and SD-WAN WANOP Appliance in various versions allows attacker to bypass authentication mechanisms via crafted requests."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8195"}, {"name": "comment", "value": "CVE-2020-8195 is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8196"}, {"name": "comment", "value": "CVE-2020-8196\n is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests."}, {"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2023-4966"}, {"name": "comment", "value": "This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens."}, {"divider": true}, {"name": "control", "value": "CVE-2023-49103"}, {"name": "comment", "value": "This vulnerability is exploited through an unauthenticated information disclosure flaw in the Graph API extension of ownCloud. Attackers first used this vulnerability to gain initial access by targeting the /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php endpoint, which allowed them to leak sensitive information via the PHP function phpinfo. By modifying the requested URI to bypass Apache web server rewrite rules, attackers could access environment variables containing secrets, such as usernames, passwords, and license keys."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4978"}, {"name": "comment", "value": "CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-23692"}, {"name": "comment", "value": "CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like \u201cGoThief\u201d to exfiltrate sensitive data. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-24919"}, {"name": "comment", "value": "CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1499.004", "score": 1, "comment": " Related to: \n \u2022CVE-2015-3043", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-3043"}, {"name": "comment", "value": "This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system."}]}, {"techniqueID": "T1204.002", "score": 32, "comment": " Related to: \n \u2022CVE-2021-21017\n\u2022CVE-2016-4117\n\u2022CVE-2023-21608\n\u2022CVE-2014-0496\n\u2022CVE-2015-3043\n\u2022CVE-2011-2462\n\u2022CVE-2009-4324\n\u2022CVE-2009-3953\n\u2022CVE-2009-1862\n\u2022CVE-2010-2883\n\u2022CVE-2015-7645\n\u2022CVE-2010-1297\n\u2022CVE-2021-28550\n\u2022CVE-2011-0611\n\u2022CVE-2018-4990\n\u2022CVE-2023-26369\n\u2022CVE-2018-15982\n\u2022CVE-2017-11292\n\u2022CVE-2024-38080\n\u2022CVE-2013-0641\n\u2022CVE-2015-3113\n\u2022CVE-2007-5659\n\u2022CVE-2016-0984\n\u2022CVE-2012-0754\n\u2022CVE-2008-2992\n\u2022CVE-2018-4878\n\u2022CVE-2012-1535\n\u2022CVE-2022-30190\n\u2022CVE-2022-34713\n\u2022CVE-2023-36884\n\u2022CVE-2008-0655\n\u2022CVE-2023-21715", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-3043"}, {"name": "comment", "value": "This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system."}, {"divider": true}, {"name": "control", "value": "CVE-2024-38080"}, {"name": "comment", "value": "This zero-day vulnerability presents itself after an adversary has already infiltrated the victim's network and enables the adversary to obtain SYSTEM level privileges via Microsoft Windows Hyper-V product. As of now, details of how the attacker's methods to exploit this vulnerability are undisclosed. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2018-4990"}, {"name": "comment", "value": "This vulnerability is exploited via embedded javascript within a user-executed malicious pdf. There are two mapped exploitation_technqiues for this CVE."}, {"divider": true}, {"name": "control", "value": "CVE-2007-5659"}, {"name": "comment", "value": "This vulnerability is exploited via a malicious PDF file in order to execute arbitrary code."}, {"divider": true}, {"name": "control", "value": "CVE-2018-4878"}, {"name": "comment", "value": "The exploitation technique for this vulnerability is based on a vulnerability in Client software.  In the wild, this was seen to be exploited by a malicious excel file.\n\nThe observed goals of this exploit from Group 123 are remote access and data exfiltration."}, {"divider": true}, {"name": "control", "value": "CVE-2021-28550"}, {"name": "comment", "value": "This exploit requires a user to open a malicious file. It can then result in execution of arbitrary code which could have any number of impacts."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21017"}, {"name": "comment", "value": "This exploit requires a user to open a malicious file. It can then result in execution of arbitrary code which could have any number of impacts."}, {"divider": true}, {"name": "control", "value": "CVE-2016-4117"}, {"name": "comment", "value": "The vulnerability is exploited by a user opening a maliciously-crafted file. Reporting on in-the-wild exploitation indicates threat actor utilize this vulnerability to install command and control software on the target system. Adversaries seen exploiting this vulnerability were also observed to do a version check on the target software before attempting the exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2016-0984"}, {"name": "comment", "value": "This use-after-free vulnerability is exploited by having the user open a maliciously-crafted file.\n\nThis CVE was observed to be exploited by the threat actor known as BlackOasis."}, {"divider": true}, {"name": "control", "value": "CVE-2009-1862"}, {"name": "comment", "value": "This vulnerability is exploited through a user opening a maliciously-crafted pdf file or swf file."}, {"divider": true}, {"name": "control", "value": "CVE-2023-21608"}, {"name": "comment", "value": "This vulnerability is exploited by having a user open a maliciously-crafted pdf file, which can result in arbitrary code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2009-4324"}, {"name": "comment", "value": "This vulnerability is exploited by having the user open a maliciously-crafted pdf file. In the wild, this has been observed to result in a malicious actor installing a custom executable on the victim's machine, and establishing communications."}, {"divider": true}, {"name": "control", "value": "CVE-2008-0655"}, {"name": "comment", "value": "This vulnerability is exploited by having a user open a maliciously-crafted pdf file."}, {"divider": true}, {"name": "control", "value": "CVE-2009-3953"}, {"name": "comment", "value": "This vulnerability is exploited by having a user open a maliciously-crafted pdf file."}, {"divider": true}, {"name": "control", "value": "CVE-2011-2462"}, {"name": "comment", "value": "This vulnerability is exploited by having the user open a malicious pdf file to achieve arbitrary code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2010-2883"}, {"name": "comment", "value": "This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26369"}, {"name": "comment", "value": "This vulnerability is exploited through a user opening a malicious PDF file. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-30190"}, {"name": "comment", "value": "This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines."}, {"divider": true}, {"name": "control", "value": "CVE-2008-2992"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted pdf file."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0641"}, {"name": "comment", "value": "This buffer overflow vulnerability is exploited via malicious-crafted pdf files delivered via targeted emails. Adversaries use this exploit to deliver a remote administration tool with the goal of data exfiltration."}, {"divider": true}, {"name": "control", "value": "CVE-2014-0496"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted file."}, {"divider": true}, {"name": "control", "value": "CVE-2017-11292"}, {"name": "comment", "value": "This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems."}, {"divider": true}, {"name": "control", "value": "CVE-2018-15982"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted Word document, which then extracts the adversary's RAT tool."}, {"divider": true}, {"name": "control", "value": "CVE-2010-1297"}, {"name": "comment", "value": "This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website.\n\nThis vulnerability is also exploited via user execution of a maliciously crafted pdf file.\n\nIn the wild, threat actors have used this to download malicious software onto the target system."}, {"divider": true}, {"name": "control", "value": "CVE-2015-3113"}, {"name": "comment", "value": "This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion."}, {"divider": true}, {"name": "control", "value": "CVE-2011-0611"}, {"name": "comment", "value": "This vulnerability is exploited by having a user execute a maliciously-crafted word document or pdf file that has embedded swf. The malicious code then downloads another payload to the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2012-1535"}, {"name": "comment", "value": "This vulnerability is exploited by having a user execute a maliciously-crafted word document that has embedded swf. The embedded swf can download additional malicious software from the web."}, {"divider": true}, {"name": "control", "value": "CVE-2015-7645"}, {"name": "comment", "value": "This vulnerability is exploited by the user opening a maliciously-crafted .swf file."}, {"divider": true}, {"name": "control", "value": "CVE-2023-21715"}, {"name": "comment", "value": "CVE-2023-21715 is a security feature bypass vulnerability exploitable when a user opens a specially-crafted file bypassing macro policies."}, {"divider": true}, {"name": "control", "value": "CVE-2022-34713"}, {"name": "comment", "value": "This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file either via an email or malicious website. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2012-0754"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted MP4 file. As a result of the exploit, malicious software is installed on the target machine."}]}, {"techniqueID": "T1203", "score": 22, "comment": " Related to: \n \u2022CVE-2021-37975\n\u2022CVE-2023-21608\n\u2022CVE-2015-5119\n\u2022CVE-2022-20701\n\u2022CVE-2021-21148\n\u2022CVE-2021-27059\n\u2022CVE-2023-36844\n\u2022CVE-2023-47565\n\u2022CVE-2021-29256\n\u2022CVE-2023-49897\n\u2022CVE-2024-5274\n\u2022CVE-2023-26369\n\u2022CVE-2024-26169\n\u2022CVE-2022-20703\n\u2022CVE-2021-39144\n\u2022CVE-2022-41128\n\u2022CVE-2023-23397\n\u2022CVE-2021-21166\n\u2022CVE-2021-21206\n\u2022CVE-2023-34048\n\u2022CVE-2021-30554\n\u2022CVE-2018-4939", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-26369"}, {"name": "comment", "value": "This vulnerability is exploited through a user opening a malicious PDF file. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-21608"}, {"name": "comment", "value": "This vulnerability is exploited by having a user open a maliciously-crafted pdf file, which can result in arbitrary code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21206"}, {"name": "comment", "value": "CVE-2021-21206 allows an adversary to use JavaScript to exploit the Blink rendering engine of the Chromium Browser that allows for execution of arbitrary code."}, {"divider": true}, {"name": "control", "value": "CVE-2021-30554"}, {"name": "comment", "value": "CVE-2021-30554 allows an adversary to use JavaScript to exploit WebGL component of the Chromium browser that allows for execution of arbitrary code."}, {"divider": true}, {"name": "control", "value": "CVE-2021-37975"}, {"name": "comment", "value": "CVE-2021-37975 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21148"}, {"name": "comment", "value": "CVE-2021-21148 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21166"}, {"name": "comment", "value": "CVE-2021-21166 allows an adversary to use JavaScript to exploit the Chromium browser via the audio object using a race condition to write into the heap. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-5274"}, {"name": "comment", "value": "This vulnerability is exploited by the hosting of malicious content on a website. Adversaries use this to deliver an information-stealing payload within Chrome."}, {"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "This vulnerability has been exploited in the wild by multiple different threat actors.  Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts.\n\nThese adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors."}, {"divider": true}, {"name": "control", "value": "CVE-2021-29256"}, {"name": "comment", "value": "This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-4939"}, {"name": "comment", "value": "This deserialization vulnerability allows adversaries to insert their own objects into client software for potential execution."}, {"divider": true}, {"name": "control", "value": "CVE-2024-26169"}, {"name": "comment", "value": "This vulnerability is a zero-day exploit that \"manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WerFault.exe and set the \"Debugger\" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges.\" This vulnerability has been exploited by the Black Basta ransomware group."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27059"}, {"name": "comment", "value": "The vulnerability allows a remote user to execute arbitrary code on the target system due to improper input validation in Microsoft Office."}, {"divider": true}, {"name": "control", "value": "CVE-2023-23397"}, {"name": "comment", "value": "This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems."}, {"divider": true}, {"name": "control", "value": "CVE-2022-20701"}, {"name": "comment", "value": "This insufficient authorization vulnerability is exploited by a local attacker who has access to  low-privileged code where they then execute commands within confd_cli at a higher privilege levels. Performing these commands could grant the local attacker root privileges. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-20703"}, {"name": "comment", "value": "This Digital Signature Verification Bypass vulnerability is exploited by an unauthenticated, local attacker. The attacker exploits an improper verification of software images that could allow the attacker to install and boot malicious images or execute unsigned binaries. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-34048"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already gained network access to the vCenter Server. The adversary sends a crafted payload to the server that has a vulnerable DCERPC protocol and causes an out-of-bounds write on the jmp rax instruction. Adversary group UNC3886 has been attributed to leveraging this vulnerability in the wild to establish a backdoor in victim vCenter servers. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-36844"}, {"name": "comment", "value": "This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web component of Juniper Networks Junos OS on EX Series devices. Attackers first use this vulnerability to gain control over certain environment variables by sending a crafted request, which allows them to manipulate these variables without authentication."}, {"divider": true}, {"name": "control", "value": "CVE-2023-49897"}, {"name": "comment", "value": "CVE-2023-49897 is an OS command injection vulnerability affecting AE1021PE firmware. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.  "}, {"divider": true}, {"name": "control", "value": "CVE-2023-47565"}, {"name": "comment", "value": "CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.  "}, {"divider": true}, {"name": "control", "value": "CVE-2021-39144"}, {"name": "comment", "value": "The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2022-41128"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who entices a user with an affected version of Windows to access a malicious server. The adversary hosts a specially crafted server share or website and convinces the user to visit it, typically through an email or chat message. The adversary then crafts a malicious Microsoft Office document that embeds a remote RTF template, which fetches HTML content rendered by Internet Explorer's JScript engine. This stealthy attack vector does not require Internet Explorer as the default browser. Once the victim opens the document and disables protected view, the adversary executes arbitrary code by triggering a type confusion error in the JScript engine. This allows the adversary to deliver malicious payloads, conduct reconnaissance, and exfiltrate data, while erasing traces of the exploit by clearing the browser cache and history. The impact on the victim includes unauthorized access to sensitive information and the potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1068", "score": 32, "comment": " Related to: \n \u2022CVE-2022-22047\n\u2022CVE-2023-28252\n\u2022CVE-2020-0787\n\u2022CVE-2022-37969\n\u2022CVE-2022-22948\n\u2022CVE-2023-28229\n\u2022CVE-2022-24521\n\u2022CVE-2023-21674\n\u2022CVE-2021-36934\n\u2022CVE-2020-1472\n\u2022CVE-2021-22900\n\u2022CVE-2022-20708\n\u2022CVE-2021-29256\n\u2022CVE-2024-37085\n\u2022CVE-2021-4034\n\u2022CVE-2021-40449\n\u2022CVE-2022-21919\n\u2022CVE-2022-41033\n\u2022CVE-2022-21999\n\u2022CVE-2022-22718\n\u2022CVE-2022-41125\n\u2022CVE-2024-38080\n\u2022CVE-2021-33739\n\u2022CVE-2020-0069\n\u2022CVE-2019-0211\n\u2022CVE-2022-26904\n\u2022CVE-2022-47966\n\u2022CVE-2021-41379\n\u2022CVE-2024-30051\n\u2022CVE-2022-41073\n\u2022CVE-2014-0546\n\u2022CVE-2023-20273", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2014-0546"}, {"name": "comment", "value": "This vulnerability allows bypassing sandbox protection and run native code."}, {"divider": true}, {"name": "control", "value": "CVE-2022-47966"}, {"name": "comment", "value": "CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.\n\nThey've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-29256"}, {"name": "comment", "value": "This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-0787"}, {"name": "comment", "value": "CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2020-0069"}, {"name": "comment", "value": "CVE-2020-0069 is an insufficient input validation vulnerability in multiple MediaTek chipsets that, combined with missing SELinux restrictions in the Command Queue drivers' ioctl handlers, allows an adversary to perform an out-of-bounds write leading to privilege escalation."}, {"divider": true}, {"name": "control", "value": "CVE-2024-38080"}, {"name": "comment", "value": "This zero-day vulnerability presents itself after an adversary has already infiltrated the victim's network and enables the adversary to obtain SYSTEM level privileges via Microsoft Windows Hyper-V product. As of now, details of how the attacker's methods to exploit this vulnerability are undisclosed. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2019-0211"}, {"name": "comment", "value": "CVE-2019-0211 is a privilege escalation vulnerability in Apache HTTP Server with MPM event, worker, or prefork that allows an attacker to execute code with the privileges of that parent process (usually root)."}, {"divider": true}, {"name": "control", "value": "CVE-2021-33739"}, {"name": "comment", "value": "Local escalation of privilege attack. Attacker would most likely gain access through an executable or script on the local computer sent to the user via an email attachment."}, {"divider": true}, {"name": "control", "value": "CVE-2024-30051"}, {"name": "comment", "value": "This vulnerability is a zero-day exploit that is believed to still be utilized by various adversarial groups leading to limited publicly available exploitation information. The vulnerability is a \"heap-based protector flood susceptibility impacting the Windows DWM Core Library\" enabling an adversary to gain SYSTEM privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2021-4034"}, {"name": "comment", "value": "The Polkit/Pwnkit vulnerability (CVE-2021-4034) is a critical vulnerability impacting every major Linux distribution. Its attack vector allows privilege escalation and can even give the attacker root access."}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472, an elevation of privilege vulnerability in Microsoft\u2019s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-20708"}, {"name": "comment", "value": "This vulnerability is exploited by bypassing user authentication mechanisms via a lack of proper validation of a user-supplied string before executing a system call. This could grant adversaries root access to execute arbitrary code. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-22948"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-37085"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named \"ESXi Admins\" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22900"}, {"name": "comment", "value": "This vulnerability is exploited through multiple unrestricted uploads. Adversaries with authenticated administrator privileges leverage this vulnerability to perform unauthorized file writes on the system via a maliciously crafted archive upload within the administrator web interface in Pulse Connect Secure."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20273"}, {"name": "comment", "value": "This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system\n\nThis CVE was exploited after the adversary exploited CVE-2023-20198."}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:"}, {"divider": true}, {"name": "control", "value": "CVE-2023-21674"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated adversary. It is identified as requiring local access via Microsoft; however, other reports have identified remote, authenticated adversaries can exploit this vulnerability. A successful exploitation would grant an attacker SYSTEM level privileges. \n\nThis vulnerability has been exploited in the wild; however, technical details of how this was leveraged in an attack has not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-28229"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain limited SYSTEM level privileges. \n\nThis vulnerability has been exploited in the wild; however, no technical information has been published related to the exploitation. Microsoft has identified that successful exploitation of this vulnerability requires an attacker to win a race condition."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26904"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already gained local access to the victim system. To exploit this vulnerability, the adversary needs to already have access to the system and must also \"win a race condition\". If successfully exploited, the adversary would gain elevated privileges on the victim system. \n\nThis vulnerability has been identified as exploited in the wild; however, technical exploitation details have not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-21919"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already gained local access to the victim system. The adversary gains access to the vulnerability either by social engineering, a separate exploit, or malware. Exploiting this vulnerability grants the adversary elevated privileges on the victim system. \n\nThis vulnerability has been identified as being exploited in the wild; however, technical details of how the vulnerability has been leveraged by a hacker or APT have not been publicly released. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-21999"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.\n\nThe exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\\Windows\\System32\\spool\\drivers\\x64\\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.\n\nThe vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22718"}, {"name": "comment", "value": "This vulnerability is leveraged by an adversary who has already gained local access to the victim system. The adversary exploits this vulnerability to elevate their privileges on the system via the Print Spooler, which could give the adversary the ability to distribute and install malicious programs on victims\u2019 computers that can steal stored data\n\nThis vulnerability has been actively exploited by cybercriminals to gain unauthorized access to corporate networks and resources. Details about who is exploiting this vulnerability and their exact movements have not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-41073"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2022-37969"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41033"}, {"name": "comment", "value": "CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41125"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22047"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24521"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system."}, {"divider": true}, {"name": "control", "value": "CVE-2021-36934"}, {"name": "comment", "value": "This vulnerability is exploited by a local or remote adversary who already has access to the system. The vulnerability enables the attacker to elevate their privileges due to over permissive ACLs on system file and elevate their privileges to SYSTEM level. By exploiting this vulnerability an attacker could gain the ability to run arbitrary code, install programs, view/modify/delete data, or create new user accounts with full rights. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2021-41379"}, {"name": "comment", "value": "The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.\n\nThis vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released. "}]}, {"techniqueID": "T1027", "score": 5, "comment": " Related to: \n \u2022CVE-2010-2883\n\u2022CVE-2021-40539\n\u2022CVE-2021-44077\n\u2022CVE-2022-24086\n\u2022CVE-2021-40449", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2010-2883"}, {"name": "comment", "value": "This vulnerability is exploited by the user opening a malicious pdf file to achieve arbitrary code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24086"}, {"name": "comment", "value": "This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated."}, {"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}]}, {"techniqueID": "T1213", "score": 2, "comment": " Related to: \n \u2022CVE-2023-35078\n\u2022CVE-2022-24086", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-24086"}, {"name": "comment", "value": "This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated."}, {"divider": true}, {"name": "control", "value": "CVE-2023-35078"}, {"name": "comment", "value": "This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. Reports state attackers who exploited this vulnerability gained access personally identifiable information (PII) and added an administrator account on the affected EPMM server, to allow for further system compromise."}]}, {"techniqueID": "T1190", "score": 127, "comment": " Related to: \n \u2022CVE-2022-29464\n\u2022CVE-2020-0688\n\u2022CVE-2021-22205\n\u2022CVE-2022-22963\n\u2022CVE-2014-6271\n\u2022CVE-2022-0028\n\u2022CVE-2022-20708\n\u2022CVE-2018-6789\n\u2022CVE-2021-34523\n\u2022CVE-2022-42475\n\u2022CVE-2024-4879\n\u2022CVE-2022-20821\n\u2022CVE-2023-27997\n\u2022CVE-2024-34102\n\u2022CVE-2022-22965\n\u2022CVE-2022-39197\n\u2022CVE-2024-21887\n\u2022CVE-2023-49103\n\u2022CVE-2023-35078\n\u2022CVE-2021-39144\n\u2022CVE-2023-34362\n\u2022CVE-2021-22893\n\u2022CVE-2021-22204\n\u2022CVE-2018-13379\n\u2022CVE-2024-20353\n\u2022CVE-2023-36845\n\u2022CVE-2013-0631\n\u2022CVE-2024-4358\n\u2022CVE-2023-22952\n\u2022CVE-2018-11776\n\u2022CVE-2022-23131\n\u2022CVE-2020-29557\n\u2022CVE-2020-15505\n\u2022CVE-2013-0625\n\u2022CVE-2021-27102\n\u2022CVE-2019-1653\n\u2022CVE-2014-7169\n\u2022CVE-2023-44487\n\u2022CVE-2021-3129\n\u2022CVE-2021-31166\n\u2022CVE-2020-17530\n\u2022CVE-2021-44228\n\u2022CVE-2022-26258\n\u2022CVE-2023-36851\n\u2022CVE-2013-0632\n\u2022CVE-2021-40539\n\u2022CVE-2023-36844\n\u2022CVE-2023-22518\n\u2022CVE-2017-5638\n\u2022CVE-2021-39226\n\u2022CVE-2021-26085\n\u2022CVE-2023-38035\n\u2022CVE-2022-28810\n\u2022CVE-2023-46604\n\u2022CVE-2022-35914\n\u2022CVE-2021-22005\n\u2022CVE-2021-35394\n\u2022CVE-2018-15961\n\u2022CVE-2021-37415\n\u2022CVE-2023-27350\n\u2022CVE-2022-26500\n\u2022CVE-2021-27065\n\u2022CVE-2021-40655\n\u2022CVE-2020-5902\n\u2022CVE-2023-29298\n\u2022CVE-2021-34473\n\u2022CVE-2019-18935\n\u2022CVE-2016-4437\n\u2022CVE-2023-26360\n\u2022CVE-2023-46805\n\u2022CVE-2023-7101\n\u2022CVE-2010-2861\n\u2022CVE-2021-21972\n\u2022CVE-2017-9805\n\u2022CVE-2022-26134\n\u2022CVE-2024-21893\n\u2022CVE-2024-27198\n\u2022CVE-2019-0604\n\u2022CVE-2024-4577\n\u2022CVE-2021-27103\n\u2022CVE-2023-20198\n\u2022CVE-2021-22986\n\u2022CVE-2021-21973\n\u2022CVE-2023-42793\n\u2022CVE-2017-9822\n\u2022CVE-2021-26858\n\u2022CVE-2023-36847\n\u2022CVE-2021-27860\n\u2022CVE-2019-11634\n\u2022CVE-2022-24086\n\u2022CVE-2021-35464\n\u2022CVE-2023-48788\n\u2022CVE-2021-22017\n\u2022CVE-2013-0629\n\u2022CVE-2022-26501\n\u2022CVE-2021-45382\n\u2022CVE-2023-20887\n\u2022CVE-2019-17558\n\u2022CVE-2021-36380\n\u2022CVE-2022-20700\n\u2022CVE-2023-36846\n\u2022CVE-2023-26359\n\u2022CVE-2018-7600\n\u2022CVE-2022-42948\n\u2022CVE-2023-3519\n\u2022CVE-2023-29300\n\u2022CVE-2009-3960\n\u2022CVE-2022-40684\n\u2022CVE-2023-33246\n\u2022CVE-2024-21762\n\u2022CVE-2023-38203\n\u2022CVE-2023-38205\n\u2022CVE-2023-35081\n\u2022CVE-2023-27524\n\u2022CVE-2022-36804\n\u2022CVE-2022-22947\n\u2022CVE-2023-29492\n\u2022CVE-2023-0669\n\u2022CVE-2023-22515\n\u2022CVE-2022-47966\n\u2022CVE-2021-44077\n\u2022CVE-2021-44529\n\u2022CVE-2022-1040\n\u2022CVE-2021-21975\n\u2022CVE-2021-44515\n\u2022CVE-2021-27104\n\u2022CVE-2018-4939", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2014-7169"}, {"name": "comment", "value": "CVE-2014-7169 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request. "}, {"divider": true}, {"name": "control", "value": "CVE-2014-6271"}, {"name": "comment", "value": "CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-0688"}, {"name": "comment", "value": "CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21972"}, {"name": "comment", "value": " CVE-2021-21972 is a RCE vulnerability affecting VMware vCenter servers. An attacker with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27065"}, {"name": "comment", "value": "CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26858"}, {"name": "comment", "value": "CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-34473"}, {"name": "comment", "value": "This is a remote code execution vulnerability that is often chained with CVE-2021-34523, a privilege escalation vulnerability."}, {"divider": true}, {"name": "control", "value": "CVE-2021-34523"}, {"name": "comment", "value": "This privilege escalation vulnerability can be exploited by sending a specially crafted HTTP request to the exchange server, is it often chained together with CVE-2021-34473, a remote code execution vulnerability."}, {"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44228"}, {"name": "comment", "value": "This remote code execution vulnerability is exploited through maliciously-crafted requests to a web application. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-0604"}, {"name": "comment", "value": "CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-18935"}, {"name": "comment", "value": "CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-15505"}, {"name": "comment", "value": "CVE-2020-15505 is an RCE vulnerability in MobileIron Core & Connector that allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors.\n\nMultiple APTs have been observed exploiting this vulnerability to gain unauthorized access."}, {"divider": true}, {"name": "control", "value": "CVE-2018-13379"}, {"name": "comment", "value": "This is a path traversal vulnerability that allows adversary to download system files through specially-crafted HTTP requests."}, {"divider": true}, {"name": "control", "value": "CVE-2019-1653"}, {"name": "comment", "value": "CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices."}, {"divider": true}, {"name": "control", "value": "CVE-2016-4437"}, {"name": "comment", "value": "CVE-2016-4437 is a code execution vulnerability in Apache Shiro that allows remote attackers to execute code or bypass access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0625"}, {"name": "comment", "value": "This vulnerability is exploited because of password misconfiguration."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0632"}, {"name": "comment", "value": "This vulnerability is exploited by logging in with an empty password on a misconfigured system. "}, {"divider": true}, {"name": "control", "value": "CVE-2009-3960"}, {"name": "comment", "value": "This vulnerability is exploited through an XML injection or XML external entity injection. In-the-wild reporting indicates adversaries have used this exploit to establish a web shell on a victim machine.\n\nThis adversary took actions to cover their tracks, establish persistence, exfiltrate Registry data, escalated privileges, moved laterally, disabled security software, installed and ran ransomware."}, {"divider": true}, {"name": "control", "value": "CVE-2022-47966"}, {"name": "comment", "value": "CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.\n\nThey've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**\n"}, {"divider": true}, {"name": "control", "value": "CVE-2018-11776"}, {"name": "comment", "value": "CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. "}, {"divider": true}, {"name": "control", "value": "CVE-2017-5638"}, {"name": "comment", "value": "CVE-2017-5638  is a remote code execution vulnerability in Apache Struts Jakarta Multipart versions that allows for malicious file upload using Content-Type, Content-Disposition, or Content-Length HTTP headers during file-upload attempts leading to an attacker to execute arbitrary commands. This CVE was known to be exploited during the Equifax breach. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-17530"}, {"name": "comment", "value": "CVE-2020-17530 is a remote code execution vulnerability in Apache Struts versions 2.0.0 - 2.5.25 allows an attacker to execute arbitrary code via forced Object Graph Navigational Language (OGNL) evaluation on raw user input in tag attributes."}, {"divider": true}, {"name": "control", "value": "CVE-2019-17558"}, {"name": "comment", "value": "CVE-2019-17558 is a vulnerability in Apache Solr that allows for Remote Code Execution (RCE) through the VelocityResponseWriter. "}, {"divider": true}, {"name": "control", "value": "CVE-2017-9805"}, {"name": "comment", "value": "CVE-2017-9805 is a deserialization vulnerability in the Apache Struts REST Plugin that could allow an attacker to execute arbitrary commands remotely on the affected systems by sending a specially crafted web request to the application."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27103"}, {"name": "comment", "value": "CVE-2021-27103 is a server-side request forgery vulnerability in Accellion File Transfer Appliance in Accellion that allows an adversary to manipulate server requests via a crafted POST request."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27102"}, {"name": "comment", "value": "CVE-2021-27102 is an operating system command execution vulnerability in Accellion File Transfer Appliance that allows an adversary to execute arbitrary commands via a local web service call.\n "}, {"divider": true}, {"name": "control", "value": "CVE-2021-27104"}, {"name": "comment", "value": "CVE-2021-27104 is an operating system command injection vulnerability in Accellion File Transfer Appliance in that allows an adversary to execute commands by sending a specially crafted POST request to the product's administrative endpoint."}, {"divider": true}, {"name": "control", "value": "CVE-2018-15961"}, {"name": "comment", "value": "This vulnerability is exploited by uploading a file to a public-facing ColdFusion server. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-4939"}, {"name": "comment", "value": "As referenced in the attached report, T1190 is a known impact of this exploit."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22205"}, {"name": "comment", "value": "CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-34102"}, {"name": "comment", "value": "This vulnerability is exploited by sending a crafted XML document that references external entities with the likely goal of accessing local data."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24086"}, {"name": "comment", "value": "This vulnerability can be exploited via a public-facing e-commerce application in order to achieve remote code execution. To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0631"}, {"name": "comment", "value": "This vulnerability is exploited via a public-facing application. The adversary can use this vulnerability to gain access to victim host information."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38205"}, {"name": "comment", "value": "CVE-2023-38205 is a vulnerability that is the result of an incomplete patch of CVE-2023-29298. An adversary remains able to exploit the public-facing application as a result of this vulnerability."}, {"divider": true}, {"name": "control", "value": "CVE-2023-29298"}, {"name": "comment", "value": "This vulnerability is used by exploited a public-facing application by exploiting a flaw in URL path validation."}, {"divider": true}, {"name": "control", "value": "CVE-2010-2861"}, {"name": "comment", "value": "This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0629"}, {"name": "comment", "value": "This is an exploitation of a public-facing server due to password misconfiguration. Exploitation allows attackers to access restricted directories."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38203"}, {"name": "comment", "value": "This vulnerability can be utilized by exploited a public-facing application.  APT groups have used this exploit to deploy webshells."}, {"divider": true}, {"name": "control", "value": "CVE-2023-29300"}, {"name": "comment", "value": "This vulnerability can be utilized by exploited a public-facing application.  APT groups have used this exploit to deploy webshells."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26359"}, {"name": "comment", "value": "This vulnerability is utilized by exploiting a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26134"}, {"name": "comment", "value": "This vulnerability is exploited by placing a payload in the URI of an HTTP request to a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-35464"}, {"name": "comment", "value": "CVE-2021-35464, a pre-auth remote code execution (RCE) vulnerability in ForgeRock Access Manager identity and access management software. ForgeRock front-ends web applications and remote access solutions in many enterprises."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22986"}, {"name": "comment", "value": "CVE-2021-22986 is a remote command execution vulnerability occurring on the iControl REST interface. Impact reported by the F5 security advisory \"This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. \""}, {"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902\u2014an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)\u2014to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, \u201cexecute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.\u201d - CISA Advisory"}, {"divider": true}, {"name": "control", "value": "CVE-2018-6789"}, {"name": "comment", "value": "CVE-2018-6789 is a vulnerability in Exim, an open-source mail transfer agent. This vulnerability, identified as an off-by-one buffer overflow, allows attackers to execute arbitrary code remotely by sending specially crafted messages to the SMTP listener. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-7600"}, {"name": "comment", "value": "CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal\u2019s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2017-9822"}, {"name": "comment", "value": "CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications"}, {"divider": true}, {"name": "control", "value": "CVE-2020-29557"}, {"name": "comment", "value": "CVE-2020-29557 is a buffer overflow vulnerability  in the web interface allows attackers to achieve pre-authentication remote code execution. Unidentified threat actors are reported to have been actively exploiting it to co-opt them to a Mirai-variant botnet used for carrying out DDoS attacks, merely two days after its public disclosure. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "Vulnerability in Citrix Receiver for Windows may allows attacker to gain read/write access to the client's local drives, potentially enabling code execution on the client device, such as deploying ransomware"}, {"divider": true}, {"name": "control", "value": "CVE-2021-3129"}, {"name": "comment", "value": "This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-44529"}, {"name": "comment", "value": "This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the \"csrf-magic\", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's \"nobody\" user account. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-40655"}, {"name": "comment", "value": "This vulnerability is exploited when an adversary forges a post request to the / get cfg.php page. The POST request could enable the adversary to obtain username and password information on the router. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-36380"}, {"name": "comment", "value": "To trigger this vulnerability, an attacker sends a specially crafted POST request to the webserver at the URL /cgi/networkDiag.cgi . Within this request, the attacker inserts a Linux command as part of the ipAddr or dnsAddr POST parameters. When the webserver processes the POST request, the command the attacker has inserted into the parameter will be executed."}, {"divider": true}, {"name": "control", "value": "CVE-2023-29492"}, {"name": "comment", "value": "CVE-2023-29492 is an insecure deserialization vulnerability. Exploitation of this vulnerability gives remote attackers arbitrary code execution in the context of the service account."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26085"}, {"name": "comment", "value": "This vulnerability allows viewing of restricted resources via a pre-authorization arbitrary file read vulnerability."}, {"divider": true}, {"name": "control", "value": "CVE-2022-36804"}, {"name": "comment", "value": "This vulnerability allows remote attackers with read permissions to a public or private Bitbucket repositories to execute arbitrary code by sending a malicious HTTP request."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22518"}, {"name": "comment", "value": "CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery and downloading malicious payloads."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27350"}, {"name": "comment", "value": "CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines."}, {"divider": true}, {"name": "control", "value": "CVE-2021-37415"}, {"name": "comment", "value": "This vulnerability allows a few REST-API URLs without authentication."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44515"}, {"name": "comment", "value": "CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-28810"}, {"name": "comment", "value": "CVE-2022-28810 is a vulnerability that exists when custom password sync scripts are enabled when an adversary passes commands in the password field that can lead to remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4358"}, {"name": "comment", "value": "CVE-2024-4358 is an authentication bypass vulnerability. This has been seen to be chained with CVE-2024-1800 in order to achieve remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2022-40684"}, {"name": "comment", "value": "This authentication bypass vulnerability allows an adversary to create an admin ssh key via any HTTP method. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-42475"}, {"name": "comment", "value": "CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP)."}, {"divider": true}, {"name": "control", "value": "CVE-2023-48788"}, {"name": "comment", "value": "This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2024-21762"}, {"name": "comment", "value": "This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27997"}, {"name": "comment", "value": "This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests.\n\nAdversaries have been observed adding accounts to config files "}, {"divider": true}, {"name": "control", "value": "CVE-2023-3519"}, {"name": "comment", "value": "This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27860"}, {"name": "comment", "value": "CVE-2021-27860 is a vulnerability in the web management interface in FatPipe software. The vulnerability allowed APT actors to gain access to an unrestricted file upload function to drop a webshell for exploitation activity with root access, leading to elevated privileges and potential follow-on activity. Exploitation of this vulnerability then served as a jumping off point into other infrastructure for the APT actors. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-20353"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. In early 2024, the Cisco Product Security Incident Response Team (PSIRT) identified an attack campaign named ArcaneDoor, which targeted these vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-20700"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who sends specific commands to a Cisco router that does not have sufficient authorization enforcement mechanisms in place. This could allow the remote attacker to gain root privileges and execute arbitrary commands on the system. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-20708"}, {"name": "comment", "value": "This vulnerability is exploited by bypassing user authentication mechanisms via a lack of proper validation of a user-supplied string before executing a system call. This could grant adversaries root access to execute arbitrary code. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-22005"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who can access the vCenter Server over the network. The adversary uploads a crafted file to the server's analytics service via port 443, exploiting the file upload vulnerability. This results in remote code execution on the host. Threat actors have been observed leveraging this vulnerability, identified as CVE-2021-22005, using code released by security researcher Jang, to gain unauthorized access to vCenter servers."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22017"}, {"name": "comment", "value": "The vulnerability in Rhttproxy within VMware's vCenter Server arises from an improper implementation of URI normalization. Attackers with network access to port 443 on the vCenter Server exploit this flaw by sending specially crafted requests, allowing them to bypass the proxy mechanism. This exploitation grants unauthorized access to internal endpoints, potentially exposing sensitive information."}, {"divider": true}, {"name": "control", "value": "CVE-2022-20821"}, {"name": "comment", "value": "This vulnerability is exploited by an unauthenticated, remote user who can access the Redis instance via port 6379 due to a health check RPM issue in IOS XR software. A successful exploitation of this vulnerability could allow an attacker the ability to write to the Redis in-memory database, write arbitrary files to the file system, or retrieve information about the Redis database. This vulnerability has been identified as being exploited in the wild, but specific details have not been released. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-21973"}, {"name": "comment", "value": "This vulnerability is exploited through an SSRF (Server Side Request Forgery) flaw in the vSphere Client (HTML5) of VMware's vCenter Server, affecting the vCenter Server plugin. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted POST request to the vCenter Server plugin, thereby bypassing URL validation. This manipulation enables the disclosure of sensitive information. By exploiting this flaw, attackers can scan the company's internal network and retrieve specifics about open ports and services."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22893"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments."}, {"divider": true}, {"name": "control", "value": "CVE-2023-46805"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-21887"}, {"name": "comment", "value": "This vulnerability is exploited through a command injection weakness in the web components of Ivanti Connect Secure and Ivanti Policy Secure. Attackers leverage this vulnerability to achieve remote code execution by sending specially crafted requests to vulnerable instances, potentially without requiring authentication when combined with other vulnerabilities. This manipulation allows attackers to execute arbitrary commands on the appliance, potentially enabling further exploitation and system compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36851"}, {"name": "comment", "value": "This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on SRX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `webauth_operation.php` endpoint, which does not require authentication. This manipulation allows attackers to cause limited impact to the file system integrity, potentially enabling further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36847"}, {"name": "comment", "value": "This vulnerability is exploited through a Missing Authentication for Critical Function weakness in Juniper Networks Junos OS on EX Series devices. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `installAppPackage.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system and enabling attackers to chain this vulnerability with others, potentially leading to further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36846"}, {"name": "comment", "value": "This vulnerability is exploited through a Missing Authentication for Critical Function weakness. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `user.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files, enabling attackers to chain this vulnerability with others, potentially leading to unauthenticated remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36845"}, {"name": "comment", "value": "This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web interface of Juniper Networks Junos OS, affecting EX Series switches and SRX Series firewalls. Attackers leverage this vulnerability to gain initial access by crafting a request that sets the PHPRC variable, thereby altering the PHP execution environment. This manipulation enables the injection and execution of arbitrary code. By exploiting the auto_prepend_file and allow_url_include PHP features, attackers can include a base64 encoded PHP payload using the data:// wrapper. This method allows them to execute code within a confined FreeBSD jail environment, with the potential to escalate privileges by stealing authentication tokens from a user logged into the J-Web application, ultimately enabling unauthorized SSH access with elevated privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2024-21893"}, {"name": "comment", "value": "This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities."}, {"divider": true}, {"name": "control", "value": "CVE-2023-35078"}, {"name": "comment", "value": "This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. This enables them to extract personally identifiable information (PII) and perform administrative actions, such as creating new accounts and making configuration changes."}, {"divider": true}, {"name": "control", "value": "CVE-2023-35081"}, {"name": "comment", "value": "This vulnerability is exploited through a path traversal flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging authenticated administrative access to remotely write arbitrary files onto the server. This enables them to deploy additional payloads, potentially granting further access and compromising the system. This vulnerability is often used in conjunction with CVE-2023-35078 (along with others) that provides unauthenticated access, enhancing the attack's capabilities. It has been actively exploited, impacting victims by leveraging both vulnerabilities together."}, {"divider": true}, {"name": "control", "value": "CVE-2023-0669"}, {"name": "comment", "value": "This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-44487"}, {"name": "comment", "value": "This vulnerability is exploited through a 'Rapid Reset' flaw in HTTP/2 endpoints. Attackers initiate this vulnerability by sending a crafted sequence of HTTP requests using HEADERS followed by RST_STREAM frames. This allows them to generate substantial traffic on targeted servers, significantly increasing CPU usage and leading to resource exhaustion without authentication."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36844"}, {"name": "comment", "value": "This vulnerability is exploited through a PHP External Variable Modification flaw in the J-Web component of Juniper Networks Junos OS on EX Series devices. Attackers first use this vulnerability to gain control over certain environment variables by sending a crafted request, which allows them to manipulate these variables without authentication."}, {"divider": true}, {"name": "control", "value": "CVE-2023-49103"}, {"name": "comment", "value": "This vulnerability is exploited through an unauthenticated information disclosure flaw in the Graph API extension of ownCloud. Attackers first used this vulnerability to gain initial access by targeting the /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php endpoint, which allowed them to leak sensitive information via the PHP function phpinfo. By modifying the requested URI to bypass Apache web server rewrite rules, attackers could access environment variables containing secrets, such as usernames, passwords, and license keys."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20198"}, {"name": "comment", "value": "This vulnerability is exploited through improper access control in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to gain initial access by issuing a privilege level 15 command, which allowed them to create a local user account with a password. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22515"}, {"name": "comment", "value": "This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-42793"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass in JetBrains TeamCity, allowing remote attackers with HTTP(S) access to perform unauthorized remote code execution. This vulnerability enables attackers to gain administrative control of the TeamCity server and execute cmd.exe for various malicious activities, including downloading and executing harmful files."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4577"}, {"name": "comment", "value": "CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4879"}, {"name": "comment", "value": "CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit."}, {"divider": true}, {"name": "control", "value": "CVE-2023-33246"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware."}, {"divider": true}, {"name": "control", "value": "CVE-2023-46604"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-27524"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who forges a session cookie leveraging user_id or _user_id set to 1 in order to log in as an administrator. A successful exploitation could allow the adversary to gain authenticated access and gain access to unauthorized resources. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-0028"}, {"name": "comment", "value": "CVE-2022-0028 is a reflected amplification Distributed-Denial-of-Service (DDoS) vulnerability with Palo Alto's PAN-OS firewall software. Public reports have announced the attempted exploit of this vulnerability to produce DDOS attack. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-27198"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by an unauthenticated, remote adversary via an alternative path issue in the web component allowing attackers to perform admin actions and achieve remote code execution. To exploit this vulnerability, attackers need to generate an unauthenticated 404 HTTP response, pass the HTTP query string \u201c?jsp=/app/rest/server\u201d, and append \u201c;.jsp\u201d to the HTTP path parameter."}, {"divider": true}, {"name": "control", "value": "CVE-2022-23131"}, {"name": "comment", "value": "This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-1040"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine. \n\nIt was actively exploited by Chinese state-sponsored APT groups, including \"Drifting Cloud,\" to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.\n\nThis vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named \"Pacific Rim.\" This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object (\"libsophos.so\"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.\n\nThis vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.\n\nThe attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely."}, {"divider": true}, {"name": "control", "value": "CVE-2022-39197"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker to execute HTML on the Cobalt Strike team server. To exploit this vulnerability, an attacker would inspect a Cobalt Strike payload and modify the username field within the payload to be malformed. This manipulation enables the attacker to execute arbitrary code by setting a malformed username in the Beacon configuration.\n\nIn a documented cybersecurity incident, a Chinese threat actor leveraged a modified version of Cobalt Strike, known as \"Cobalt Strike Cat,\" which included a patch for CVE-2022-39197. This version was used to establish communication channels with victim systems, perform evasive post-exploitation activities, and maintain persistence. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-7101"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker by passing unvalidated input from a file into a string-type \"eval\". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. After successful exploitation, the attacker gains the ability to perform remote code execution. This vulnerability has been targeted by Chinese hackers who exploited the vulnerability in Spreadsheet::ParseExcel to compromise appliances. In collaboration with cybersecurity firm Mandiant, Barracuda assesses that the threat actor behind the attacks is UNC4841, who leveraged the flaw to deploy \u2018SeaSpy\u2019 and \u2018Saltwater\u2019 malware."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-35914"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker via /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2, which allows PHP code injection.\n\nin the wild exploitation details have not been publicly released for this vulnerability"}, {"divider": true}, {"name": "control", "value": "CVE-2022-22965"}, {"name": "comment", "value": "This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the \"/tmp\" directory and changing its permissions to make it executable using \"chmod.\" The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures."}, {"divider": true}, {"name": "control", "value": "CVE-2022-42948"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker. The vulnerability is caused by improper escaping of HTML tags in Swing components. This flaw allows the attacker to inject crafted HTML code, enabling them to execute code within the Cobalt Strike UI. Exploitation can occur through a graphical file explorer menu, allowing attackers to perform unauthorized operations on the administrative interface."}, {"divider": true}, {"name": "control", "value": "CVE-2021-39144"}, {"name": "comment", "value": "The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22204"}, {"name": "comment", "value": "The vulnerability is exploited by a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to improper input validation when parsing DjVu files in ExifTool. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26500"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.\n\nThis vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26501"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.\n\nThis vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection."}, {"divider": true}, {"name": "control", "value": "CVE-2021-45382"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and  IZ1H9 to cause a distributed denial of service attack. \n\nIn the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.\n\nIn the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called \"ddns.sh.\" This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26258"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an adversary via HTTP POST to get set ccp. The exploit targets a command injection vulnerability in the /lan.asp component. The component does not successfully sanitize the value of the HTTP parameter DeviceName, which in turn can lead to arbitrary command execution. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called MooBot to cause a distributed denial of service attack. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-22963"}, {"name": "comment", "value": "In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as \"Spring4Shell,\" can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20887"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated actor to gain remote code execution via a command injection attack. This vulnerability has been exploited in the wild; however, technical details have not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-22947"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2022-29464"}, {"name": "comment", "value": "CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency."}, {"divider": true}, {"name": "control", "value": "CVE-2021-39226"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published. \n\nIn exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the \"public_mode\" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss."}, {"divider": true}, {"name": "control", "value": "CVE-2021-31166"}, {"name": "comment", "value": "This memory corruption vulnerability is exploited by a remote, unauthenticated attacker via crafted HTTP packets to a server that uses http.sys to process packets. Adversaries may leverage this vulnerability to execute malicious code on the OS kernel. This vulnerability has a proof of concept validating that it can be wormable. However, exploitations in the wild linking to this type of impact have not been published. \n\nThe North Korean state-backed hacker group known as the Lazarus Group has been attributed to leveraging this vulnerability in their attacks to gain initial access to Windows IIS servers. Once initial access is gained, they have exploited the vulnerable system to perform data theft, disrupt services, propagate malware, or conduct espionage or surveillance. \n\n**team review - AttackerKB links Command and Scripting to this vulnerability, but I have not found any threat reports linking this impact to an actual attack. The only \"in the wild\" report I found was by SecureBlink linking it to the Lazarus Group to gain initial access. Unsure what primary impact we can link to here. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-21975"}, {"name": "comment", "value": "This Server-Side Request Forgery (SSRF) vulnerability is exploited by an attacker with network access to the VMware server. This vulnerability enables the attacker to exploit an unauthenticated endpoint to send crafted requests to internal or external systems. By doing so, the attacker can potentially steal administrative credentials. Once these credentials are compromised, the attacker could gain maximum privileges within the application, enabling them to alter configurations and intercept sensitive data. This exploitation could lead to unauthorized access and manipulation of the application."}]}, {"techniqueID": "T1133", "score": 20, "comment": " Related to: \n \u2022CVE-2014-7169\n\u2022CVE-2021-1497\n\u2022CVE-2014-6271\n\u2022CVE-2019-19781\n\u2022CVE-2019-11510\n\u2022CVE-2020-1472\n\u2022CVE-2020-8515\n\u2022CVE-2023-27532\n\u2022CVE-2022-20699\n\u2022CVE-2023-20269\n\u2022CVE-2020-25506\n\u2022CVE-2019-0708\n\u2022CVE-2021-22986\n\u2022CVE-2019-3396\n\u2022CVE-2021-26855\n\u2022CVE-2021-26857\n\u2022CVE-2019-5591\n\u2022CVE-2020-5902\n\u2022CVE-2018-4939\n\u2022CVE-2021-1498", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2014-7169"}, {"name": "comment", "value": "CVE-2014-7169 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request. "}, {"divider": true}, {"name": "control", "value": "CVE-2014-6271"}, {"name": "comment", "value": "CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472 is a privilege escalation vulnerability in Windows Netlogon. After gaining initial access, the actors exploit CVE-2020-1472 to compromise all Active Directory (AD) identity services. Actors have then been observed using legitimate remote access tools, such as VPN and Remote Desktop Protocol (RDP), to access the environment with the compromised credentials."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26857"}, {"name": "comment", "value": "CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26855"}, {"name": "comment", "value": "CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information."}, {"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)"}, {"divider": true}, {"name": "control", "value": "CVE-2019-11510"}, {"name": "comment", "value": "CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-19781"}, {"name": "comment", "value": "CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC). "}, {"divider": true}, {"name": "control", "value": "CVE-2018-4939"}, {"name": "comment", "value": "As referenced in the attached report, T1133 is a known impact of this exploit."}, {"divider": true}, {"name": "control", "value": "CVE-2021-1498"}, {"name": "comment", "value": "CVE-2021-1498 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device"}, {"divider": true}, {"name": "control", "value": "CVE-2021-1497"}, {"name": "comment", "value": "CVE-2021-1497 is a critical vulnerability in the web-based management interface of Cisco HyperFlex HX Installer Virtual Machine. This vulnerability allows an unauthenticated, remote attacker to perform a command injection attack against an affected device"}, {"divider": true}, {"name": "control", "value": "CVE-2019-3396"}, {"name": "comment", "value": "CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-5591"}, {"name": "comment", "value": "CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8515"}, {"name": "comment", "value": "CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use."}, {"divider": true}, {"name": "control", "value": "CVE-2020-25506"}, {"name": "comment", "value": "CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-22986"}, {"name": "comment", "value": "The iControl REST interface has an unauthenticated remote command execution vulnerability. This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services."}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472, an elevation of privilege vulnerability in Microsoft\u2019s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-0708"}, {"name": "comment", "value": "CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20269"}, {"name": "comment", "value": "This vulnerability is exploited by an unauthenticated, remote attacker by specifying a default connection profile/tunnel group, enabling a brute-force attack to identify valid credentials and establish a clienteles SSL VPN session using  those valid credentials."}, {"divider": true}, {"name": "control", "value": "CVE-2022-20699"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker by \"sending a specially crafted HTTP request to a vulnerable device that is acting as an SSL VPN Gateway.\u201d This can be performed due to insufficient boundary checks when processing specific HTTP requests. If exploited, this could grant root privileges to the attacker. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-27532"}, {"name": "comment", "value": "CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. "}]}, {"techniqueID": "T1059.004", "score": 9, "comment": " Related to: \n \u2022CVE-2023-46604\n\u2022CVE-2014-7169\n\u2022CVE-2023-38831\n\u2022CVE-2021-36380\n\u2022CVE-2022-20700\n\u2022CVE-2019-0708\n\u2022CVE-2022-20699\n\u2022CVE-2014-6271\n\u2022CVE-2024-24919", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2014-7169"}, {"name": "comment", "value": "CVE-2014-7169 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request. "}, {"divider": true}, {"name": "control", "value": "CVE-2014-6271"}, {"name": "comment", "value": "CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-36380"}, {"name": "comment", "value": "To trigger this vulnerability, an attacker sends a specially crafted POST request to the webserver at the URL /cgi/networkDiag.cgi . Within this request, the attacker inserts a Linux command as part of the ipAddr or dnsAddr POST parameters. When the webserver processes the POST request, the command the attacker has inserted into the parameter will be executed."}, {"divider": true}, {"name": "control", "value": "CVE-2019-0708"}, {"name": "comment", "value": "CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems."}, {"divider": true}, {"name": "control", "value": "CVE-2022-20699"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker by \"sending a specially crafted HTTP request to a vulnerable device that is acting as an SSL VPN Gateway.\u201d This can be performed due to insufficient boundary checks when processing specific HTTP requests. If exploited, this could grant root privileges to the attacker. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-20700"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who sends specific commands to a Cisco router that does not have sufficient authorization enforcement mechanisms in place. This could allow the remote attacker to gain root privileges and execute arbitrary commands on the system. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-24919"}, {"name": "comment", "value": "CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-46604"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. "}]}, {"techniqueID": "T1059.007", "score": 13, "comment": " Related to: \n \u2022CVE-2018-4990\n\u2022CVE-2022-24682\n\u2022CVE-2021-37975\n\u2022CVE-2023-5631\n\u2022CVE-2023-26360\n\u2022CVE-2022-22963\n\u2022CVE-2021-21166\n\u2022CVE-2021-21206\n\u2022CVE-2015-5119\n\u2022CVE-2013-3346\n\u2022CVE-2021-30554\n\u2022CVE-2021-21148\n\u2022CVE-2023-22515", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-21206"}, {"name": "comment", "value": "CVE-2021-21206 allows an adversary to use JavaScript to exploit the Blink rendering engine of the Chromium Browser that allows for execution of arbitrary code."}, {"divider": true}, {"name": "control", "value": "CVE-2021-30554"}, {"name": "comment", "value": "CVE-2021-30554 allows an adversary to use JavaScript to exploit WebGL component of the Chromium browser that allows for execution of arbitrary code."}, {"divider": true}, {"name": "control", "value": "CVE-2021-37975"}, {"name": "comment", "value": "CVE-2021-37975 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21148"}, {"name": "comment", "value": "CVE-2021-21148 allows an adversary to use JavaScript to exploit the Chromium browser V8 JavaScript engine which allows for a write into the heap."}, {"divider": true}, {"name": "control", "value": "CVE-2021-21166"}, {"name": "comment", "value": "CVE-2021-21166 allows an adversary to use JavaScript to exploit the Chromium browser via the audio object using a race condition to write into the heap. "}, {"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2018-4990"}, {"name": "comment", "value": "This vulnerability is exploited via embedded javascript within a user-executed malicious pdf. There are two mapped exploitation_technqiues for this CVE."}, {"divider": true}, {"name": "control", "value": "CVE-2013-3346"}, {"name": "comment", "value": "This vulnerability is exploited via maliciously-crafted javascript."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22515"}, {"name": "comment", "value": "This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-5631"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24682"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker via spear-phishing emails containing malicious links to inject arbitrary HTML and JavaScript into the document by placing executable JavaScript inside element attributes. This results in unescaped markup, enabling the attacker to execute JavaScript in the context of a user's Zimbra session, leading to potential data theft and other malicious activities.\n\nThis vulnerability was identified by Volexity in December 2021 during a series of targeted spear-phishing campaigns conducted by a threat actor tracked as TEMP_Heretic. The campaigns aimed to exploit this zero-day vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's Zimbra session.\n\nThe attack involved two phases: an initial reconnaissance phase using emails with embedded remote images to track if targets opened the messages, and a second phase with spear-phishing emails containing malicious links. If a target clicked on these links while logged into the Zimbra webmail client, the attacker could exploit the vulnerability to steal email data and attachments."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22963"}, {"name": "comment", "value": "In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as \"Spring4Shell,\" can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework."}]}, {"techniqueID": "T1136.001", "score": 2, "comment": " Related to: \n \u2022CVE-2022-47966\n\u2022CVE-2022-21999", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-47966"}, {"name": "comment", "value": "CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.\n\nThey've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**\n"}, {"divider": true}, {"name": "control", "value": "CVE-2022-21999"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.\n\nThe exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\\Windows\\System32\\spool\\drivers\\x64\\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.\n\nThe vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns."}]}, {"techniqueID": "T1114", "score": 1, "comment": " Related to: \n \u2022CVE-2020-0688", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-0688"}, {"name": "comment", "value": "CVE-2020-0688 is a remote code execution vulnerability exists in Microsoft Exchange Server. CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks. Also, Threat actors used credentials in conjunction with known vulnerabilities on public-facing applications, such as virtual private networks (VPNs)\u2014CVE-2020-0688 and CVE-2020-17144\u2014to escalate privileges and gain remote code execution (RCE) on the exposed applications."}]}, {"techniqueID": "T1505.003", "score": 19, "comment": " Related to: \n \u2022CVE-2020-0688\n\u2022CVE-2023-26360\n\u2022CVE-2022-22963\n\u2022CVE-2022-22954\n\u2022CVE-2023-46805\n\u2022CVE-2021-44228\n\u2022CVE-2021-40539\n\u2022CVE-2024-21893\n\u2022CVE-2019-0604\n\u2022CVE-2021-26855\n\u2022CVE-2021-26858\n\u2022CVE-2021-44077\n\u2022CVE-2021-26857\n\u2022CVE-2021-27065\n\u2022CVE-2021-27860\n\u2022CVE-2022-41082\n\u2022CVE-2023-22952\n\u2022CVE-2023-32315\n\u2022CVE-2019-18935", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-27065"}, {"name": "comment", "value": "CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26858"}, {"name": "comment", "value": "CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26857"}, {"name": "comment", "value": "CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26855"}, {"name": "comment", "value": "CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information."}, {"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "CVE-2021-40539 is an authentication bypass vulnerability affecting representational state transfer (REST) application programming interface (API) URLs that could enable remote code execution. Successful exploitation of the vulnerability allows an attacker to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-44228"}, {"name": "comment", "value": "CVE-2021-44228, known as Log4Shell, affects Apache\u2019s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity."}, {"divider": true}, {"name": "control", "value": "CVE-2020-0688"}, {"name": "comment", "value": "CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide."}, {"divider": true}, {"name": "control", "value": "CVE-2019-0604"}, {"name": "comment", "value": "CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-18935"}, {"name": "comment", "value": "CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22954"}, {"name": "comment", "value": "This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2021-27860"}, {"name": "comment", "value": "CVE-2021-27860 is a vulnerability in the web management interface in FatPipe software. The vulnerability allowed APT actors to gain access to an unrestricted file upload function to drop a webshell for exploitation activity with root access, leading to elevated privileges and potential follow-on activity. Exploitation of this vulnerability then served as a jumping off point into other infrastructure for the APT actors. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-46805"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-21893"}, {"name": "comment", "value": "This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities."}, {"divider": true}, {"name": "control", "value": "CVE-2023-32315"}, {"name": "comment", "value": "CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.  "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-22963"}, {"name": "comment", "value": "In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as \"Spring4Shell,\" can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework."}]}, {"techniqueID": "T1090", "score": 3, "comment": " Related to: \n \u2022CVE-2019-3396\n\u2022CVE-2021-22986\n\u2022CVE-2021-26855", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-26855"}, {"name": "comment", "value": "CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information."}, {"divider": true}, {"name": "control", "value": "CVE-2019-3396"}, {"name": "comment", "value": "CVE-2019-3396 is a critical server-side template injection vulnerability in Atlassian Confluence Server and Data Center that could lead to remote code execution. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-22986"}, {"name": "comment", "value": "The iControl REST interface has an unauthenticated remote command execution vulnerability. This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services."}]}, {"techniqueID": "T1486", "score": 15, "comment": " Related to: \n \u2022CVE-2022-22947\n\u2022CVE-2023-28252\n\u2022CVE-2021-42258\n\u2022CVE-2021-45046\n\u2022CVE-2015-8651\n\u2022CVE-2019-11634\n\u2022CVE-2023-38831\n\u2022CVE-2009-3960\n\u2022CVE-2023-36884\n\u2022CVE-2023-27532\n\u2022CVE-2021-44228\n\u2022CVE-2021-34473\n\u2022CVE-2016-1019\n\u2022CVE-2020-1472\n\u2022CVE-2023-0669", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-34473"}, {"name": "comment", "value": "CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-44228"}, {"name": "comment", "value": "CVE-2021-44228, known as Log4Shell, affects Apache\u2019s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity."}, {"divider": true}, {"name": "control", "value": "CVE-2009-3960"}, {"name": "comment", "value": "This vulnerability is exploited through an XML injection or XML external entity injection. In-the-wild reporting indicates adversaries have used this exploit to establish a web shell on a victim machine.\n\nThis adversary took actions to cover their tracks, establish persistence, exfiltrate Registry data, escalated privileges, moved laterally, disabled security software, installed and ran ransomware."}, {"divider": true}, {"name": "control", "value": "CVE-2016-1019"}, {"name": "comment", "value": "This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit.  After exploit, adversaries can install their own malware or specifically ransomware."}, {"divider": true}, {"name": "control", "value": "CVE-2021-42258"}, {"name": "comment", "value": "CVE-2021-42258 is a SQL injection vulnerability in BillQuick Web Suite that allows  attackers to execute arbitrary SQL commands on the database server"}, {"divider": true}, {"name": "control", "value": "CVE-2015-8651"}, {"name": "comment", "value": "This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits whose goal is frequently to load ransomware onto the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "Vulnerability in Citrix Receiver for Windows may allows attacker to gain read/write access to the client's local drives, potentially enabling code execution on the client device, such as deploying ransomware"}, {"divider": true}, {"name": "control", "value": "CVE-2021-45046"}, {"name": "comment", "value": "CVE 2021-45046 is a Log4J-related vulnerability that has been seen to be used in cryptomining and ransomware operations. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472, an elevation of privilege vulnerability in Microsoft\u2019s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. CVE-2020-1472 has been reported to be exploited by Ransomware groups for initial access.  "}, {"divider": true}, {"name": "control", "value": "CVE-2023-0669"}, {"name": "comment", "value": "This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-27532"}, {"name": "comment", "value": "CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:"}, {"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22947"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations. \n"}]}, {"techniqueID": "T1048.003", "score": 1, "comment": " Related to: \n \u2022CVE-2021-34473", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-34473"}, {"name": "comment", "value": "CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. "}]}, {"techniqueID": "T1136", "score": 9, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077\n\u2022CVE-2023-28252\n\u2022CVE-2021-34473\n\u2022CVE-2023-20198\n\u2022CVE-2023-35078\n\u2022CVE-2023-27997\n\u2022CVE-2023-34362\n\u2022CVE-2023-22515", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-34473"}, {"name": "comment", "value": "CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27997"}, {"name": "comment", "value": "This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests.\n\nAdversaries have been observed adding accounts to config files "}, {"divider": true}, {"name": "control", "value": "CVE-2023-35078"}, {"name": "comment", "value": "This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. Reports state attackers who exploited this vulnerability gained access personally identifiable information (PII) and added an administrator account on the affected EPMM server, to allow for further system compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20198"}, {"name": "comment", "value": "This vulnerability is exploited through improper access control in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to gain initial access by issuing a privilege level 15 command, which allowed them to create a local user account with a password. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22515"}, {"name": "comment", "value": "This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:"}]}, {"techniqueID": "T1053.005", "score": 2, "comment": " Related to: \n \u2022CVE-2023-46604\n\u2022CVE-2021-34473", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-34473"}, {"name": "comment", "value": "CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-46604"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. "}]}, {"techniqueID": "T1573.001", "score": 3, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077\n\u2022CVE-2021-40449", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}]}, {"techniqueID": "T1560.001", "score": 2, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}]}, {"techniqueID": "T1087.002", "score": 5, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077\n\u2022CVE-2023-3519\n\u2022CVE-2023-32315\n\u2022CVE-2020-1472", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2023-3519"}, {"name": "comment", "value": "This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data."}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472, an elevation of privilege vulnerability in Microsoft\u2019s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-32315"}, {"name": "comment", "value": "CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.  "}]}, {"techniqueID": "T1070.004", "score": 4, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2023-22952\n\u2022CVE-2020-5902\n\u2022CVE-2021-44077", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)"}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}]}, {"techniqueID": "T1047", "score": 2, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}]}, {"techniqueID": "T1003.003", "score": 3, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077\n\u2022CVE-2024-24919", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2024-24919"}, {"name": "comment", "value": "CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. "}]}, {"techniqueID": "T1218", "score": 2, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}]}, {"techniqueID": "T1003", "score": 9, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2019-13608\n\u2022CVE-2021-44077\n\u2022CVE-2023-28252\n\u2022CVE-2019-11634\n\u2022CVE-2020-5902\n\u2022CVE-2021-44515\n\u2022CVE-2021-22893\n\u2022CVE-2019-0604", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2019-0604"}, {"name": "comment", "value": "CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. "}, {"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)"}, {"divider": true}, {"name": "control", "value": "CVE-2019-13608"}, {"name": "comment", "value": "CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.\n"}, {"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows "}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44515"}, {"name": "comment", "value": "CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-22893"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments."}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:"}]}, {"techniqueID": "T1140", "score": 2, "comment": " Related to: \n \u2022CVE-2021-40539\n\u2022CVE-2021-44077", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40539"}, {"name": "comment", "value": "This is an authentication bypass vulnerability that can enable remote code execution. \n\nNumerous post-exploitation impacts by threat actors are detailed in the referenced CISA report."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44077"}, {"name": "comment", "value": "CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control."}]}, {"techniqueID": "T1496", "score": 18, "comment": " Related to: \n \u2022CVE-2023-47565\n\u2022CVE-2024-23692\n\u2022CVE-2022-29464\n\u2022CVE-2021-22205\n\u2022CVE-2018-7600\n\u2022CVE-2020-8515\n\u2022CVE-2021-26084\n\u2022CVE-2023-38035\n\u2022CVE-2023-1389\n\u2022CVE-2023-32315\n\u2022CVE-2023-22527\n\u2022CVE-2021-35394\n\u2022CVE-2021-44228\n\u2022CVE-2022-29303\n\u2022CVE-2018-11776\n\u2022CVE-2017-9822\n\u2022CVE-2019-18935\n\u2022CVE-2023-49897", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44228"}, {"name": "comment", "value": "CVE-2021-44228, known as Log4Shell, affects Apache\u2019s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity."}, {"divider": true}, {"name": "control", "value": "CVE-2019-18935"}, {"name": "comment", "value": "CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-11776"}, {"name": "comment", "value": "CVE-2018-11776 is a remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers when alwaysSelectFullNamespace is true and then results are used with no namespace. Volexity also reports active scanning and attempts to exploit CVE-2018-11776 in order to deploy cryptocurrency miners."}, {"divider": true}, {"name": "control", "value": "CVE-2021-26084"}, {"name": "comment", "value": "CVE-2021-26084 is a critical vulnerability affecting Atlassian Confluence Server and Data Center that allows unauthenticated remote code execution. This Object-Graph Navigation Language (OGNL) injection vulnerability enables attackers to execute arbitrary code on vulnerable Confluence instances"}, {"divider": true}, {"name": "control", "value": "CVE-2021-22205"}, {"name": "comment", "value": "CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-7600"}, {"name": "comment", "value": "CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal\u2019s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2020-8515"}, {"name": "comment", "value": "CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use."}, {"divider": true}, {"name": "control", "value": "CVE-2017-9822"}, {"name": "comment", "value": "CVE-2017-9822 is a vulnerability allows an attacker to exploit cookie deserialization, leading to remote code execution (RCE). It has been noted for its potential impact on various web applications"}, {"divider": true}, {"name": "control", "value": "CVE-2023-22527"}, {"name": "comment", "value": "CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes."}, {"divider": true}, {"name": "control", "value": "CVE-2022-29303"}, {"name": "comment", "value": "CVE-2022-29303 is a command injection vulnerability within a PHP component in the product's web server. \nReports indicate that the vulnerability have been exploited by operators of Mirai botnet malware. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-1389"}, {"name": "comment", "value": "CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router\u2019s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-32315"}, {"name": "comment", "value": "CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.  "}, {"divider": true}, {"name": "control", "value": "CVE-2024-23692"}, {"name": "comment", "value": "CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like \u201cGoThief\u201d to exfiltrate sensitive data. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-49897"}, {"name": "comment", "value": "CVE-2023-49897 is an OS command injection vulnerability affecting AE1021PE firmware. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.  "}, {"divider": true}, {"name": "control", "value": "CVE-2023-47565"}, {"name": "comment", "value": "CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.  "}, {"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-29464"}, {"name": "comment", "value": "CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency."}]}, {"techniqueID": "T1608.001", "score": 5, "comment": " Related to: \n \u2022CVE-2024-37085\n\u2022CVE-2021-44228\n\u2022CVE-2023-33246\n\u2022CVE-2019-0604\n\u2022CVE-2024-20353", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44228"}, {"name": "comment", "value": "CVE-2021-44228, known as Log4Shell, affects Apache\u2019s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity."}, {"divider": true}, {"name": "control", "value": "CVE-2019-0604"}, {"name": "comment", "value": "CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-20353"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-37085"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named \"ESXi Admins\" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments."}, {"divider": true}, {"name": "control", "value": "CVE-2023-33246"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who leverages a command injection flaw in Apache RocketMQ versions 5.1 and lower. By using the update configuration function, the adversary can execute commands as the system user under which RocketMQ is running. This lack of permission verification in components like NameServer, Broker, and Controller, which are exposed on the extranet, allows for remote command execution. Additionally, attackers can forge RocketMQ protocol content to achieve the same effect. Since at least June 2023, threat actors have actively exploited this vulnerability to gain initial access and deploy the DreamBus botnet, a Linux-based malware."}]}, {"techniqueID": "T1110", "score": 2, "comment": " Related to: \n \u2022CVE-2020-0688\n\u2022CVE-2020-1472", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-0688"}, {"name": "comment", "value": "CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide."}, {"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts."}]}, {"techniqueID": "T1021", "score": 2, "comment": " Related to: \n \u2022CVE-2023-28252\n\u2022CVE-2020-1472", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-1472"}, {"name": "comment", "value": "CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs.\n\nBased on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:"}]}, {"techniqueID": "T1041", "score": 7, "comment": " Related to: \n \u2022CVE-2023-5631\n\u2022CVE-2023-2868\n\u2022CVE-2023-1389\n\u2022CVE-2018-4878\n\u2022CVE-2023-38831\n\u2022CVE-2019-18935\n\u2022CVE-2019-0604", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-0604"}, {"name": "comment", "value": "CVE-2019-0604 is a vulnerability in an XML deserialization component within Microsoft SharePoint allowed remote attackers to typically install webshell malware to vulnerable hosts. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-18935"}, {"name": "comment", "value": "CVE 2019-18935 is a Insecure Deserialization vulnerability with the Telerik UI, which does not properly sanitize serialized data inputs from the user. This vulnerability leads to the application being vulnerable to RCE attacks that may lead to a full system compromise. "}, {"divider": true}, {"name": "control", "value": "CVE-2018-4878"}, {"name": "comment", "value": "The exploitation technique for this vulnerability is based on a vulnerability in Client software.  In the wild, this was seen to be exploited by a malicious excel file.\n\nThe observed goals of this exploit from Group 123 are remote access and data exfiltration."}, {"divider": true}, {"name": "control", "value": "CVE-2023-2868"}, {"name": "comment", "value": "CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions."}, {"divider": true}, {"name": "control", "value": "CVE-2023-1389"}, {"name": "comment", "value": "CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router\u2019s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-5631"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser."}]}, {"techniqueID": "T1566.001", "score": 5, "comment": " Related to: \n \u2022CVE-2017-11292\n\u2022CVE-2023-2868\n\u2022CVE-2013-0640\n\u2022CVE-2022-41033\n\u2022CVE-2017-11882", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2017-11882"}, {"name": "comment", "value": "CVE-2020-0688 exists in Microsoft Office, which is prone to a memory corruption vulnerability allowing an attacker to run arbitrary code if unpatched, in the context of the current user, by failing to properly handle objects in memory. Cyber actors continued to exploit this vulnerability in Microsoft Office.  The vulnerability is ideal for phishing campaigns, and it enables RCE on vulnerable systems."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0640"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted pdf delivered as an email attachment."}, {"divider": true}, {"name": "control", "value": "CVE-2017-11292"}, {"name": "comment", "value": "This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems."}, {"divider": true}, {"name": "control", "value": "CVE-2023-2868"}, {"name": "comment", "value": "CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41033"}, {"name": "comment", "value": "CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights."}]}, {"techniqueID": "T1562.001", "score": 2, "comment": " Related to: \n \u2022CVE-2023-22952\n\u2022CVE-2020-5902", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)"}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}]}, {"techniqueID": "T1083", "score": 3, "comment": " Related to: \n \u2022CVE-2019-19781\n\u2022CVE-2023-22952\n\u2022CVE-2019-11510", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-11510"}, {"name": "comment", "value": "CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-19781"}, {"name": "comment", "value": "CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC). "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}]}, {"techniqueID": "T1552.001", "score": 2, "comment": " Related to: \n \u2022CVE-2022-26138\n\u2022CVE-2019-11510", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-11510"}, {"name": "comment", "value": "CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-26138"}, {"name": "comment", "value": "CVE-2022-26138 is a hard-coded credentials vulnerability in the \"Questions for Confluence\" app."}]}, {"techniqueID": "T1548", "score": 2, "comment": " Related to: \n \u2022CVE-2022-1388\n\u2022CVE-2022-23131", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-1388"}, {"name": "comment", "value": "This CVE is an authentication bypass vulnerability. Unauthenticated users with network access can execute arbitrary commands."}, {"divider": true}, {"name": "control", "value": "CVE-2022-23131"}, {"name": "comment", "value": "This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. "}]}, {"techniqueID": "T1189", "score": 17, "comment": " Related to: \n \u2022CVE-2024-5274\n\u2022CVE-2010-1297\n\u2022CVE-2015-0310\n\u2022CVE-2024-38112\n\u2022CVE-2014-8439\n\u2022CVE-2015-0313\n\u2022CVE-2015-8651\n\u2022CVE-2015-3043\n\u2022CVE-2023-7024\n\u2022CVE-2012-2034\n\u2022CVE-2016-7855\n\u2022CVE-2010-0188\n\u2022CVE-2012-5054\n\u2022CVE-2023-43770\n\u2022CVE-2016-1019\n\u2022CVE-2024-4671\n\u2022CVE-2024-4947", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-0313"}, {"name": "comment", "value": "This use-after-free vulnerability is exploited in-the-wild by drive-by-download."}, {"divider": true}, {"name": "control", "value": "CVE-2024-5274"}, {"name": "comment", "value": "This vulnerability is exploited by the hosting of malicious content on a website. Adversaries use this to deliver an information-stealing payload within Chrome."}, {"divider": true}, {"name": "control", "value": "CVE-2016-1019"}, {"name": "comment", "value": "This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit.  After exploit, adversaries can install their own malware or specifically ransomware."}, {"divider": true}, {"name": "control", "value": "CVE-2010-0188"}, {"name": "comment", "value": "This vulnerability is exploited via drive-by download. Malicious software is this downloaded on the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2016-7855"}, {"name": "comment", "value": "This vulnerability is exploited by having users visit a maliciously website."}, {"divider": true}, {"name": "control", "value": "CVE-2010-1297"}, {"name": "comment", "value": "This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website.\n\nThis vulnerability is also exploited via user execution of a maliciously crafted pdf file.\n\nIn the wild, threat actors have used this to download malicious software onto the target system."}, {"divider": true}, {"name": "control", "value": "CVE-2012-5054"}, {"name": "comment", "value": "This vulnerability can be exploited by a malicioiusly-crafted webpage via drive-by compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2014-8439"}, {"name": "comment", "value": "This vulnerability is exploited with maliciously-crafted code hosted on a webpage via drive-by compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2015-8651"}, {"name": "comment", "value": "This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits whose goal is frequently to load ransomware onto the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2015-0310"}, {"name": "comment", "value": "This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits."}, {"divider": true}, {"name": "control", "value": "CVE-2012-2034"}, {"name": "comment", "value": "This vulnerability is exploited by a maliciously-crafted .swf via drive-by compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2015-3043"}, {"name": "comment", "value": "This vulnerability is exploited by a maliciously-crafted .swf file which can be run on a user system via drive-by compromise."}, {"divider": true}, {"name": "control", "value": "CVE-2024-38112"}, {"name": "comment", "value": "This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4671"}, {"name": "comment", "value": "CVE-2024-4671 is a use-after-free vulnerability where an adversary can perform a sandbox escape via a maliciously-crafted HTML page."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4947"}, {"name": "comment", "value": "CVE-2024-4947 is a type confusion vulnerability in Chrome's V8 JavaScript engine.\n\nAdversaries have been observed exploiting this vulnerability by hosting a web-based game on a site that triggered the vulnerability and executed arbitrary code. \n\nAdversaries promoted the game on social media and through emails."}, {"divider": true}, {"name": "control", "value": "CVE-2023-43770"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system. \n\nThe Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services."}, {"divider": true}, {"name": "control", "value": "CVE-2023-7024"}, {"name": "comment", "value": "This heap buffer overflow vulnerability is exploited by a remote attacker via a crafted HTML page. This vulnerability has been leveraged by the NSO group to enable remote code execution within a browser's WebRTC component to install the spyware Pegasus on victim endpoints."}]}, {"techniqueID": "T1565", "score": 1, "comment": " Related to: \n \u2022CVE-2021-31207", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-31207"}, {"name": "comment", "value": "This vulnerability is exploited via authentication bypass, allowing the adversary to write to files."}]}, {"techniqueID": "T1071.001", "score": 9, "comment": " Related to: \n \u2022CVE-2023-26360\n\u2022CVE-2022-42475\n\u2022CVE-2021-35394\n\u2022CVE-2015-3113\n\u2022CVE-2024-4978\n\u2022CVE-2015-5119\n\u2022CVE-2009-4324\n\u2022CVE-2021-40449\n\u2022CVE-2023-38035", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2009-4324"}, {"name": "comment", "value": "This vulnerability is exploited by having the user open a maliciously-crafted pdf file. In the wild, this has been observed to result in a malicious actor installing a custom executable on the victim's machine, and establishing communications."}, {"divider": true}, {"name": "control", "value": "CVE-2015-3113"}, {"name": "comment", "value": "This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion."}, {"divider": true}, {"name": "control", "value": "CVE-2022-42475"}, {"name": "comment", "value": "CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP)."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4978"}, {"name": "comment", "value": "CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2."}, {"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}]}, {"techniqueID": "T1055.001", "score": 1, "comment": " Related to: \n \u2022CVE-2015-5119", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "This vulnerability has been exploited in the wild by multiple different threat actors.  Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts.\n\nThese adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors."}]}, {"techniqueID": "T1105", "score": 32, "comment": " Related to: \n \u2022CVE-2016-4117\n\u2022CVE-2023-26360\n\u2022CVE-2015-5119\n\u2022CVE-2023-7101\n\u2022CVE-2010-2861\n\u2022CVE-2010-1297\n\u2022CVE-2023-2868\n\u2022CVE-2023-3519\n\u2022CVE-2023-22518\n\u2022CVE-2023-29300\n\u2022CVE-2011-0611\n\u2022CVE-2023-38203\n\u2022CVE-2023-38035\n\u2022CVE-2018-15982\n\u2022CVE-2017-11292\n\u2022CVE-2023-38831\n\u2022CVE-2021-35394\n\u2022CVE-2013-0641\n\u2022CVE-2016-0984\n\u2022CVE-2023-34362\n\u2022CVE-2012-0754\n\u2022CVE-2024-23692\n\u2022CVE-2023-27350\n\u2022CVE-2015-8651\n\u2022CVE-2012-1535\n\u2022CVE-2022-30190\n\u2022CVE-2024-4978\n\u2022CVE-2023-20867\n\u2022CVE-2023-48788\n\u2022CVE-2021-44515\n\u2022CVE-2010-0188\n\u2022CVE-2016-1019", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload."}, {"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2016-1019"}, {"name": "comment", "value": "This vulnerability is exploited by taking advantage of a flaw of Adobe Flash embedded within browsers. In the wild, threat actors have been seen using a browser-based exploit kit to initiate a drive-by compromise of the exploit.  After exploit, adversaries can install their own malware or specifically ransomware."}, {"divider": true}, {"name": "control", "value": "CVE-2016-4117"}, {"name": "comment", "value": "The vulnerability is exploited by a user opening a maliciously-crafted file. Reporting on in-the-wild exploitation indicates threat actor utilize this vulnerability to install command and control software on the target system. Adversaries seen exploiting this vulnerability were also observed to do a version check on the target software before attempting the exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2016-0984"}, {"name": "comment", "value": "This use-after-free vulnerability is exploited by having the user open a maliciously-crafted file.\n\nThis CVE was observed to be exploited by the threat actor known as BlackOasis. The threat actor then installs command and control tools."}, {"divider": true}, {"name": "control", "value": "CVE-2010-2861"}, {"name": "comment", "value": "This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38203"}, {"name": "comment", "value": "This vulnerability can be utilized by exploited a public-facing application.  APT groups have used this exploit to deploy webshells."}, {"divider": true}, {"name": "control", "value": "CVE-2023-29300"}, {"name": "comment", "value": "This vulnerability can be utilized by exploited a public-facing application.  APT groups have used this exploit to deploy webshells."}, {"divider": true}, {"name": "control", "value": "CVE-2022-30190"}, {"name": "comment", "value": "This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines."}, {"divider": true}, {"name": "control", "value": "CVE-2010-0188"}, {"name": "comment", "value": "This vulnerability is exploited via drive-by download. Malicious software is this downloaded on the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2013-0641"}, {"name": "comment", "value": "This buffer overflow vulnerability is exploited via malicious-crafted pdf files delivered via targeted emails. Adversaries use this exploit to deliver a remote administration tool with the goal of data exfiltration."}, {"divider": true}, {"name": "control", "value": "CVE-2017-11292"}, {"name": "comment", "value": "This vulnerability is exploited using a malicious-crafted word document attached to spearphishing emails. Adversaries have been seen to leverage this to install exploit code from their command & control server. This malware then performs data collection on the target systems."}, {"divider": true}, {"name": "control", "value": "CVE-2018-15982"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted Word document, which then extracts the adversary's RAT tool."}, {"divider": true}, {"name": "control", "value": "CVE-2010-1297"}, {"name": "comment", "value": "This vulnerability is exploited by crafted swf content via drive-by compromise when a user visits a malicious website.\n\nThis vulnerability is also exploited via user execution of a maliciously crafted pdf file.\n\nIn the wild, threat actors have used this to download malicious software onto the target system."}, {"divider": true}, {"name": "control", "value": "CVE-2015-8651"}, {"name": "comment", "value": "This vulnerability is exploited with maliciously-crafted code hosted on a website via drive-by compromise. It has been seen used in the wild by exploit kits whose goal is frequently to load ransomware onto the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2011-0611"}, {"name": "comment", "value": "This vulnerability is exploited by having a user execute a maliciously-crafted word document or pdf file that has embedded swf. The malicious code then downloads another payload to the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2012-1535"}, {"name": "comment", "value": "This vulnerability is exploited by having a user execute a maliciously-crafted word document that has embedded swf. The embedded swf can download additional malicious software from the web."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22518"}, {"name": "comment", "value": "CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery, downloading malicious payloads,  "}, {"divider": true}, {"name": "control", "value": "CVE-2023-27350"}, {"name": "comment", "value": "CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines."}, {"divider": true}, {"name": "control", "value": "CVE-2021-44515"}, {"name": "comment", "value": "CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2023-48788"}, {"name": "comment", "value": "This is an SQL injection vulnerability that can be exploited to execute remote code via specially crafted HTTP requests. Adversaries have been observed using this exploit to deploy tools on the target machine."}, {"divider": true}, {"name": "control", "value": "CVE-2023-3519"}, {"name": "comment", "value": "This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data."}, {"divider": true}, {"name": "control", "value": "CVE-2023-2868"}, {"name": "comment", "value": "CVE-2023-2868 in the Barracuda Email Security Gateway (ESG) had been reportedly exploited for espionage and exfiltration efforts by UNC4841 attributed by Mandiant. Following the exploitation of CVE-2023-2868, malware SALTWATER, SEASPY, and SEASIDE were identified to be used in intrusions."}, {"divider": true}, {"name": "control", "value": "CVE-2024-4978"}, {"name": "comment", "value": "CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-23692"}, {"name": "comment", "value": "CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like \u201cGoThief\u201d to exfiltrate sensitive data. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-7101"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker by passing unvalidated input from a file into a string-type \"eval\". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. After successful exploitation, the attacker gains the ability to perform remote code execution. This vulnerability has been targeted by Chinese hackers who exploited the vulnerability in Spreadsheet::ParseExcel to compromise appliances. In collaboration with cybersecurity firm Mandiant, Barracuda assesses that the threat actor behind the attacks is UNC4841, who leveraged the flaw to deploy \u2018SeaSpy\u2019 and \u2018Saltwater\u2019 malware."}, {"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20867"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}, {"divider": true}, {"name": "control", "value": "CVE-2012-0754"}, {"name": "comment", "value": "This vulnerability is exploited via a maliciously-crafted MP4 file. As a result of the exploit, malicious software is installed on the target machine."}]}, {"techniqueID": "T1204.001", "score": 11, "comment": " Related to: \n \u2022CVE-2022-24682\n\u2022CVE-2020-3580\n\u2022CVE-2023-5631\n\u2022CVE-2023-2136\n\u2022CVE-2022-3038\n\u2022CVE-2024-38112\n\u2022CVE-2022-3075\n\u2022CVE-2015-5119\n\u2022CVE-2023-5217\n\u2022CVE-2012-0767\n\u2022CVE-2022-21971", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload."}, {"divider": true}, {"name": "control", "value": "CVE-2012-0767"}, {"name": "comment", "value": "This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website.  The attacker \ncan then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail."}, {"divider": true}, {"name": "control", "value": "CVE-2020-3580"}, {"name": "comment", "value": "CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface\nor access sensitive browser-based information. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-38112"}, {"name": "comment", "value": "This vulnerability is exploited through a victim visiting a malicious Web page or to clicking on an unsafe link. After visiting the website or clicking on the link, an adversary would gain the ability to execute arbitrary code on the victim system."}, {"divider": true}, {"name": "control", "value": "CVE-2023-5631"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.  \n\nIn recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.\n\nThe checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24682"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker via spear-phishing emails containing malicious links to inject arbitrary HTML and JavaScript into the document by placing executable JavaScript inside element attributes. This results in unescaped markup, enabling the attacker to execute JavaScript in the context of a user's Zimbra session, leading to potential data theft and other malicious activities.\n\nThis vulnerability was identified by Volexity in December 2021 during a series of targeted spear-phishing campaigns conducted by a threat actor tracked as TEMP_Heretic. The campaigns aimed to exploit this zero-day vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's Zimbra session.\n\nThe attack involved two phases: an initial reconnaissance phase using emails with embedded remote images to track if targets opened the messages, and a second phase with spear-phishing emails containing malicious links. If a target clicked on these links while logged into the Zimbra webmail client, the attacker could exploit the vulnerability to steal email data and attachments."}, {"divider": true}, {"name": "control", "value": "CVE-2023-5217"}, {"name": "comment", "value": "This vulnerability was exploited by a remote attacker using a crafted HTML page to trigger a heap buffer overflow in the vp8 encoding of libvpx, leading to heap corruption. This flaw was part of a spyware campaign. The exploitation allowed for program crashes or arbitrary code execution, ultimately resulting in the installation of spyware."}, {"divider": true}, {"name": "control", "value": "CVE-2022-3038"}, {"name": "comment", "value": "This vulnerability has been exploited by a remote attacker to perform a sandbox escape via a crafted HTML page that allowed the attacker to exploit a heap corruption. This vulnerability was chained together with other CVEs during a spyware campaign performed by a customer or partner of a Spanish spyware company known as Variston IT."}, {"divider": true}, {"name": "control", "value": "CVE-2022-21971"}, {"name": "comment", "value": "This vulnerability is exploited when an authenticated user is convinced by an attacker to download and open a specially crafted file from a website, which grants the attacker access to the victim's computer. No articles have been released to the public showing that this vulnerability has been executed in the wild or provides any information on how an exploitation is carried out. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-3075"}, {"name": "comment", "value": "This data validation vulnerability is exploited by a remote attacker who compromised the renderer process via a crafted HTML page to potentially perform a sandbox escape. \n\nExploitation in the wild techniques have not been published by Google. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-2136"}, {"name": "comment", "value": "This integer overflow vulnerability is exploited by a remote attacker who has already compromised the renderer process of Google Chrome. Exploiting this vulnerability might lead to incorrect rendering, memory corruption, and arbitrary code execution that could grant the adversary unauthorized access to the system. \n\nExploitation in the wild techniques have not been publicly released to reduce further abuse. "}]}, {"techniqueID": "T1566.002", "score": 1, "comment": " Related to: \n \u2022CVE-2015-5119", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-5119"}, {"name": "comment", "value": "To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload."}]}, {"techniqueID": "T1548.002", "score": 1, "comment": " Related to: \n \u2022CVE-2021-31207", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-31207"}, {"name": "comment", "value": "This vulnerability is exploited via authentication bypass, allowing the adversary to write to files."}]}, {"techniqueID": "T1222", "score": 1, "comment": " Related to: \n \u2022CVE-2022-22960", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-22960"}, {"name": "comment", "value": "This vulnerability allows adversaries with local access to escalate privileges to root. Adversaries have been observed chaining this following exploit of CVE-2022-22954."}]}, {"techniqueID": "T1221", "score": 3, "comment": " Related to: \n \u2022CVE-2022-22954\n\u2022CVE-2024-23692\n\u2022CVE-2023-22527", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-22954"}, {"name": "comment", "value": "This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22527"}, {"name": "comment", "value": "CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes."}, {"divider": true}, {"name": "control", "value": "CVE-2024-23692"}, {"name": "comment", "value": "CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like \u201cGoThief\u201d to exfiltrate sensitive data. "}]}, {"techniqueID": "T1114.002", "score": 1, "comment": " Related to: \n \u2022CVE-2012-0767", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2012-0767"}, {"name": "comment", "value": "This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website.  The attacker \ncan then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail."}]}, {"techniqueID": "T1098", "score": 1, "comment": " Related to: \n \u2022CVE-2012-0767", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2012-0767"}, {"name": "comment", "value": "This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website.  The attacker \ncan then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail."}]}, {"techniqueID": "T1185", "score": 2, "comment": " Related to: \n \u2022CVE-2012-0767\n\u2022CVE-2022-24682", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2012-0767"}, {"name": "comment", "value": "This cross-site scripting vulnerability has been exploited in the wild by enticing a user to click on a link to a malicious website.  The attacker \ncan then impersonate the user and perform actions such as changing the user's settings on the website or accessing the user's webmail."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24682"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker via spear-phishing emails containing malicious links to inject arbitrary HTML and JavaScript into the document by placing executable JavaScript inside element attributes. This results in unescaped markup, enabling the attacker to execute JavaScript in the context of a user's Zimbra session, leading to potential data theft and other malicious activities.\n\nThis vulnerability was identified by Volexity in December 2021 during a series of targeted spear-phishing campaigns conducted by a threat actor tracked as TEMP_Heretic. The campaigns aimed to exploit this zero-day vulnerability, allowing attackers to execute arbitrary JavaScript in the context of a user's Zimbra session.\n\nThe attack involved two phases: an initial reconnaissance phase using emails with embedded remote images to track if targets opened the messages, and a second phase with spear-phishing emails containing malicious links. If a target clicked on these links while logged into the Zimbra webmail client, the attacker could exploit the vulnerability to steal email data and attachments."}]}, {"techniqueID": "T1046", "score": 5, "comment": " Related to: \n \u2022CVE-2019-13608\n\u2022CVE-2023-26360\n\u2022CVE-2019-11634\n\u2022CVE-2021-21973\n\u2022CVE-2023-38035", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}, {"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows "}, {"divider": true}, {"name": "control", "value": "CVE-2019-13608"}, {"name": "comment", "value": "CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-21973"}, {"name": "comment", "value": "This vulnerability is exploited through an SSRF (Server Side Request Forgery) flaw in the vSphere Client (HTML5) of VMware's vCenter Server, affecting the vCenter Server plugin. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted POST request to the vCenter Server plugin, thereby bypassing URL validation. This manipulation enables the disclosure of sensitive information. By exploiting this flaw, attackers can scan the company's internal network and retrieve specifics about open ports and services."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}]}, {"techniqueID": "T1003.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-26360", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}]}, {"techniqueID": "T1036.005", "score": 1, "comment": " Related to: \n \u2022CVE-2023-26360", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}]}, {"techniqueID": "T1484.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-26360", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-26360"}, {"name": "comment", "value": "This vulnerability gives an adversary access through exploitation of a public-facing server."}]}, {"techniqueID": "T1210", "score": 3, "comment": " Related to: \n \u2022CVE-2021-41773\n\u2022CVE-2021-42013\n\u2022CVE-2023-0669", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-42013"}, {"name": "comment", "value": "CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied,\" these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2021-41773"}, {"name": "comment", "value": "CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied,\" these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution."}, {"divider": true}, {"name": "control", "value": "CVE-2023-0669"}, {"name": "comment", "value": "This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group. "}]}, {"techniqueID": "T1574", "score": 15, "comment": " Related to: \n \u2022CVE-2024-21762\n\u2022CVE-2023-3519\n\u2022CVE-2022-3038\n\u2022CVE-2022-42475\n\u2022CVE-2022-1040\n\u2022CVE-2023-4966\n\u2022CVE-2022-41073\n\u2022CVE-2023-7024\n\u2022CVE-2016-1010\n\u2022CVE-2023-27997\n\u2022CVE-2022-41328\n\u2022CVE-2017-6742\n\u2022CVE-2023-6549\n\u2022CVE-2023-5217\n\u2022CVE-2020-5735", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-5735"}, {"name": "comment", "value": "CVE-2020-5735 is a stack-based buffer overflow vulnerability in Amcrest cameras and NVR that allows an authenticated remote attacker to possibly execute unauthorized code over port 37777 and crash the device."}, {"divider": true}, {"name": "control", "value": "CVE-2016-1010"}, {"name": "comment", "value": "This vulnerability is exploited via an integer overflow."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41328"}, {"name": "comment", "value": "CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections."}, {"divider": true}, {"name": "control", "value": "CVE-2022-42475"}, {"name": "comment", "value": "CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP)."}, {"divider": true}, {"name": "control", "value": "CVE-2024-21762"}, {"name": "comment", "value": "This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27997"}, {"name": "comment", "value": "This buffer overflow vulnerability allows adversaries to remotely execute arbitrary code via specially crafted requests.\n\nAdversaries have been observed adding accounts to config files "}, {"divider": true}, {"name": "control", "value": "CVE-2023-3519"}, {"name": "comment", "value": "This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data."}, {"divider": true}, {"name": "control", "value": "CVE-2023-6549"}, {"name": "comment", "value": "This buffer overflow vulnerability can be exploited to cause a denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2023-4966"}, {"name": "comment", "value": "This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.  "}, {"divider": true}, {"name": "control", "value": "CVE-2017-6742"}, {"name": "comment", "value": "CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC\u2019s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41073"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2022-1040"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine. \n\nIt was actively exploited by Chinese state-sponsored APT groups, including \"Drifting Cloud,\" to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.\n\nThis vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named \"Pacific Rim.\" This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object (\"libsophos.so\"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.\n\nThis vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.\n\nThe attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely."}, {"divider": true}, {"name": "control", "value": "CVE-2023-5217"}, {"name": "comment", "value": "This vulnerability was exploited by a remote attacker using a crafted HTML page to trigger a heap buffer overflow in the vp8 encoding of libvpx, leading to heap corruption. This flaw was part of a spyware campaign. The exploitation allowed for program crashes or arbitrary code execution, ultimately resulting in the installation of spyware."}, {"divider": true}, {"name": "control", "value": "CVE-2022-3038"}, {"name": "comment", "value": "This vulnerability has been exploited by a remote attacker to perform a sandbox escape via a crafted HTML page that allowed the attacker to exploit a heap corruption. This vulnerability was chained together with other CVEs during a spyware campaign performed by a customer or partner of a Spanish spyware company known as Variston IT."}, {"divider": true}, {"name": "control", "value": "CVE-2023-7024"}, {"name": "comment", "value": "This heap buffer overflow vulnerability is exploited by a remote attacker via a crafted HTML page. This vulnerability has been leveraged by the NSO group to enable remote code execution within a browser's WebRTC component to install the spyware Pegasus on victim endpoints."}]}, {"techniqueID": "T1499", "score": 5, "comment": " Related to: \n \u2022CVE-2023-20109\n\u2022CVE-2023-44487\n\u2022CVE-2021-35394\n\u2022CVE-2023-6549\n\u2022CVE-2020-5735", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-5735"}, {"name": "comment", "value": "CVE-2020-5735 is a stack-based buffer overflow vulnerability in Amcrest cameras and NVR that allows an authenticated remote attacker to possibly execute unauthorized code over port 37777 and crash the device."}, {"divider": true}, {"name": "control", "value": "CVE-2023-6549"}, {"name": "comment", "value": "This buffer overflow vulnerability can be exploited to cause a denial of service."}, {"divider": true}, {"name": "control", "value": "CVE-2023-20109"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability has been identified as being exploited in the wild by Chinese adversary groups. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-44487"}, {"name": "comment", "value": "This vulnerability is exploited through a 'Rapid Reset' flaw in HTTP/2 endpoints. Attackers initiate this vulnerability by sending a crafted sequence of HTTP requests using HEADERS followed by RST_STREAM frames. This allows them to generate substantial traffic on targeted servers, significantly increasing CPU usage and leading to resource exhaustion without authentication."}, {"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}]}, {"techniqueID": "T1007", "score": 1, "comment": " Related to: \n \u2022CVE-2019-1653", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-1653"}, {"name": "comment", "value": "CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices."}]}, {"techniqueID": "T1082", "score": 7, "comment": " Related to: \n \u2022CVE-2024-23692\n\u2022CVE-2019-1653\n\u2022CVE-2021-40449\n\u2022CVE-2023-43770\n\u2022CVE-2020-8195\n\u2022CVE-2023-34362\n\u2022CVE-2020-8196", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-1653"}, {"name": "comment", "value": "CVE-2019-1653 is a critical information disclosure vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. This vulnerability allows unauthenticated, remote attackers to access sensitive information from affected devices."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8195"}, {"name": "comment", "value": "CVE-2020-8195 is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8196"}, {"name": "comment", "value": "CVE-2020-8196\n is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests."}, {"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}, {"divider": true}, {"name": "control", "value": "CVE-2024-23692"}, {"name": "comment", "value": "CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like \u201cGoThief\u201d to exfiltrate sensitive data. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2023-43770"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system. \n\nThe Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services."}]}, {"techniqueID": "T1219", "score": 1, "comment": " Related to: \n \u2022CVE-2018-4878", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2018-4878"}, {"name": "comment", "value": "The exploitation technique for this vulnerability is based on a vulnerability in Client software.  In the wild, this was seen to be exploited by a malicious excel file.\n\nThe observed goals of this exploit from Group 123 are remote access and data exfiltration.\n\nInstallation of the remote access software could allow for a number of different secondary impacts. See the MITRE ATT&CK reference on the DOGCALL software for more information."}]}, {"techniqueID": "T1491.002", "score": 1, "comment": " Related to: \n \u2022CVE-2018-15961", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2018-15961"}, {"name": "comment", "value": "In the wild, this CVE was seen to result in defacement."}]}, {"techniqueID": "T1598.002", "score": 1, "comment": " Related to: \n \u2022CVE-2021-33739", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-33739"}, {"name": "comment", "value": "Local escalation of privilege attack. Attacker would most likely gain access through an executable or script on the local computer sent to the user via an email attachment."}]}, {"techniqueID": "T1498", "score": 6, "comment": " Related to: \n \u2022CVE-2023-47565\n\u2022CVE-2021-22205\n\u2022CVE-2023-1389\n\u2022CVE-2019-0708\n\u2022CVE-2023-49897\n\u2022CVE-2022-0028", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-22205"}, {"name": "comment", "value": "CVE-2021-22205 is a Remote Code Execution Vulnerability on GitLab Community and Enterprise Editions where threat actors have been reported to actively exploit the security flaw to co-opt unpatched GitLab servers into a botnet and launch distributed denial of service (DDoS) attacks"}, {"divider": true}, {"name": "control", "value": "CVE-2021-22205"}, {"name": "comment", "value": "CVE-2021-22205 is a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability was reported to be actively exploited for o assemble botnets and launch gigantic distributed denial of service (DDoS) attacks. "}, {"divider": true}, {"name": "control", "value": "CVE-2019-0708"}, {"name": "comment", "value": "CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems."}, {"divider": true}, {"name": "control", "value": "CVE-2023-1389"}, {"name": "comment", "value": "CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router\u2019s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-49897"}, {"name": "comment", "value": "CVE-2023-49897 is an OS command injection vulnerability affecting AE1021PE firmware. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.  "}, {"divider": true}, {"name": "control", "value": "CVE-2023-47565"}, {"name": "comment", "value": "CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices.  "}, {"divider": true}, {"name": "control", "value": "CVE-2022-0028"}, {"name": "comment", "value": "CVE-2022-0028 is a reflected amplification Distributed-Denial-of-Service (DDoS) vulnerability with Palo Alto's PAN-OS firewall software. Public reports have announced the attempted exploit of this vulnerability to produce DDOS attack. "}]}, {"techniqueID": "T1078", "score": 39, "comment": " Related to: \n \u2022CVE-2021-42321\n\u2022CVE-2022-22047\n\u2022CVE-2023-28252\n\u2022CVE-2022-37969\n\u2022CVE-2023-46805\n\u2022CVE-2022-22948\n\u2022CVE-2023-28229\n\u2022CVE-2022-20701\n\u2022CVE-2022-24521\n\u2022CVE-2024-20399\n\u2022CVE-2023-21674\n\u2022CVE-2021-36934\n\u2022CVE-2019-13608\n\u2022CVE-2024-37085\n\u2022CVE-2024-21893\n\u2022CVE-2022-21919\n\u2022CVE-2023-20269\n\u2022CVE-2022-21999\n\u2022CVE-2022-22718\n\u2022CVE-2022-41125\n\u2022CVE-2021-22899\n\u2022CVE-2024-20359\n\u2022CVE-2023-27524\n\u2022CVE-2021-22894\n\u2022CVE-2023-22515\n\u2022CVE-2023-20109\n\u2022CVE-2022-26904\n\u2022CVE-2021-41379\n\u2022CVE-2023-23397\n\u2022CVE-2022-26500\n\u2022CVE-2019-11634\n\u2022CVE-2022-1040\n\u2022CVE-2022-41082\n\u2022CVE-2022-41073\n\u2022CVE-2023-20867\n\u2022CVE-2023-22952\n\u2022CVE-2023-41179\n\u2022CVE-2022-23131\n\u2022CVE-2023-20273", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-11634"}, {"name": "comment", "value": "CVE-2019-11634 is a remote code execution vulnerability for Citrix Workspace Application and Receiver for Windows "}, {"divider": true}, {"name": "control", "value": "CVE-2019-13608"}, {"name": "comment", "value": "CVE-2019-13608 is a an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.\n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-23397"}, {"name": "comment", "value": "This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems."}, {"divider": true}, {"name": "control", "value": "CVE-2024-20399"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has access to administrator credentials. The adversary leverages these credentials to execute arbitrary commands using root privileges. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-20109"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability has been identified as being exploited in the wild by Chinese adversary groups. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-20269"}, {"name": "comment", "value": "This vulnerability is exploited by an unauthenticated, remote attacker by specifying a default connection profile/tunnel group, enabling a brute-force attack to identify valid credentials and establish a clienteles SSL VPN session using those valid credentials."}, {"divider": true}, {"name": "control", "value": "CVE-2024-20359"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated, local attacker in order to execute arbitrary code with root-level privileges by copying a crafted file to the disk0: file system. This is possible due to improper validation of a file when it is read from system flash memory. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-20701"}, {"name": "comment", "value": "This insufficient authorization vulnerability is exploited by a local attacker who has access to  low-privileged code where they then execute commands within confd_cli at a higher privilege levels. Performing these commands could grant the local attacker root privileges. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-22948"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-37085"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named \"ESXi Admins\" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22899"}, {"name": "comment", "value": "This vulnerability is exploited through a command injection weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution on the target system via the Windows Resource Profiles Feature."}, {"divider": true}, {"name": "control", "value": "CVE-2021-22894"}, {"name": "comment", "value": "This vulnerability is exploited through a buffer overflow weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution with root privileges on the Pulse Connect Secure gateway by manipulating input buffers."}, {"divider": true}, {"name": "control", "value": "CVE-2023-46805"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-21893"}, {"name": "comment", "value": "This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities."}, {"divider": true}, {"name": "control", "value": "CVE-2023-22515"}, {"name": "comment", "value": "This vulnerability is exploited through improper input validation in Atlassian Confluence, allowing remote attackers to translate arbitrary HTTP parameters into getter/setter sequences via the XWorks2 middleware. This vulnerability enables the creation of unauthorized Confluence administrator accounts and the upload of malicious plugins, granting attackers the ability to modify Java objects at runtime and execute arbitrary code. A nation-state actor known as Storm-0062 has been attributed to exploiting this vulnerability in the wild. \n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2023-20273"}, {"name": "comment", "value": "This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write an implant to the file system, further compromising the device.\n\nThis CVE was exploited after the adversary exploited CVE-2023-20198."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27524"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who forges a session cookie leveraging user_id or _user_id set to 1 in order to log in as an administrator. A successful exploitation could allow the adversary to gain authenticated access and gain access to unauthorized resources. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-28252"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. \n\nThis CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an \"ESX Admins\" group to encrypt the ESXi file system and disrupt hosted VMs."}, {"divider": true}, {"name": "control", "value": "CVE-2023-21674"}, {"name": "comment", "value": "This vulnerability is exploited by an authenticated adversary. It is identified as requiring local access via Microsoft; however, other reports have identified remote, authenticated adversaries can exploit this vulnerability. A successful exploitation would grant an attacker SYSTEM level privileges. \n\nThis vulnerability has been exploited in the wild; however, technical details of how this was leveraged in an attack has not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-28229"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain limited SYSTEM level privileges. \n\nThis vulnerability has been exploited in the wild; however, no technical information has been published related to the exploitation. Microsoft has identified that successful exploitation of this vulnerability requires an attacker to win a race condition."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26904"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already gained local access to the victim system. To exploit this vulnerability, the adversary needs to already have access to the system and must also \"win a race condition\". If successfully exploited, the adversary would gain elevated privileges on the victim system. \n\nThis vulnerability has been identified as exploited in the wild; however, technical exploitation details have not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-21919"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already gained local access to the victim system. The adversary gains access to the vulnerability either by social engineering, a separate exploit, or malware. Exploiting this vulnerability grants the adversary elevated privileges on the victim system. \n\nThis vulnerability has been identified as being exploited in the wild; however, technical details of how the vulnerability has been leveraged by a hacker or APT have not been publicly released. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-21999"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.\n\nThe exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\\Windows\\System32\\spool\\drivers\\x64\\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.\n\nThe vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22718"}, {"name": "comment", "value": "This vulnerability is leveraged by an adversary who has already gained local access to the victim system. The adversary exploits this vulnerability to elevate their privileges on the system via the Print Spooler, which could give the adversary the ability to distribute and install malicious programs on victims\u2019 computers that can steal stored data\n\nThis vulnerability has been actively exploited by cybercriminals to gain unauthorized access to corporate networks and resources. Details about who is exploiting this vulnerability and their exact movements have not been publicly shared. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-41073"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges."}, {"divider": true}, {"name": "control", "value": "CVE-2022-37969"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41125"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system."}, {"divider": true}, {"name": "control", "value": "CVE-2022-22047"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-24521"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system."}, {"divider": true}, {"name": "control", "value": "CVE-2021-36934"}, {"name": "comment", "value": "This vulnerability is exploited by a local or remote adversary who already has access to the system. The vulnerability enables the attacker to elevate their privileges due to over permissive ACLs on system file and elevate their privileges to SYSTEM level. By exploiting this vulnerability an attacker could gain the ability to run arbitrary code, install programs, view/modify/delete data, or create new user accounts with full rights. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-41379"}, {"name": "comment", "value": "The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.\n\nThis vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-23131"}, {"name": "comment", "value": "This vulnerability is exploited by a malicious actor via improper validation via SAML to modify session data and escalate privileges to gain admin access to the Zabbix Frontend. This allows attackers to control the saml_data[username_attribute] value. This flaw enables unauthenticated users to bypass authentication and access the Zabbix dashboard as a highly-privileged user, such as the default \"Admin\" user. Additionally, incorrect handling of Zabbix installer files permits unauthenticated users to access and reconfigure servers. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-1040"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine. \n\nIt was actively exploited by Chinese state-sponsored APT groups, including \"Drifting Cloud,\" to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.\n\nThis vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named \"Pacific Rim.\" This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object (\"libsophos.so\"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.\n\nThis vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.\n\nThe attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely."}, {"divider": true}, {"name": "control", "value": "CVE-2023-41179"}, {"name": "comment", "value": "This vulnerability is exploited by a remote attacker who has obtained administrative console access on the target system. Successful exploitation of the flaw could allow an attacker to manipulate the component to execute arbitrary commands on an affected installation. This vulnerability has been exploited in the wild. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26500"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.\n\nThis vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection."}, {"divider": true}, {"name": "control", "value": "CVE-2021-42321"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has gained authentication to the Exchange Server and exploited validation issues in command-let arguments. This gives the adversary access to perform remote code execution on the server. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-20867"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has fully compromised ESXi host. The adversary can exploit the authentication bypass flaw, leading to a failure in authenticating host-to-guest operations. The threat group UNC3886 has exploited this vulnerability to deploy VirtualPita and VirtualPie backdoors on guest VMs by escalating privileges to root on compromised ESXi hosts. This allows for unauthenticated command execution and file transfer."}]}, {"techniqueID": "T1592", "score": 1, "comment": " Related to: \n \u2022CVE-2013-0631", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2013-0631"}, {"name": "comment", "value": "This vulnerability is exploited via a public-facing application. The adversary can use this vulnerability to gain access to victim host information."}]}, {"techniqueID": "T1217", "score": 1, "comment": " Related to: \n \u2022CVE-2020-3580", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-3580"}, {"name": "comment", "value": "CVE-2020-3580 is a vulnerability affecting the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link to to execute arbitrary script code within the interface\nor access sensitive browser-based information. "}]}, {"techniqueID": "T1119", "score": 1, "comment": " Related to: \n \u2022CVE-2010-2861", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2010-2861"}, {"name": "comment", "value": "This is the exploitation of a public facing server. In-the-wild reporting documents that exploitation of this vulnerability was used to install a webshell on the victim machine, and then captured and exfiltrated client credit card information."}]}, {"techniqueID": "T1497", "score": 2, "comment": " Related to: \n \u2022CVE-2014-0546\n\u2022CVE-2015-3113", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2014-0546"}, {"name": "comment", "value": "This vulnerability allows bypassing sandbox protection and run native code."}, {"divider": true}, {"name": "control", "value": "CVE-2015-3113"}, {"name": "comment", "value": "This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion."}]}, {"techniqueID": "T1048", "score": 4, "comment": " Related to: \n \u2022CVE-2022-26501\n\u2022CVE-2017-6742\n\u2022CVE-2022-26500\n\u2022CVE-2013-0641", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2013-0641"}, {"name": "comment", "value": "This buffer overflow vulnerability is exploited via malicious-crafted pdf files delivered via targeted emails. Adversaries use this exploit to deliver a remote administration tool with the goal of data exfiltration."}, {"divider": true}, {"name": "control", "value": "CVE-2017-6742"}, {"name": "comment", "value": "CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC\u2019s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26500"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.\n\nThis vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26501"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.\n\nThis vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection."}]}, {"techniqueID": "T1622", "score": 2, "comment": " Related to: \n \u2022CVE-2022-42475\n\u2022CVE-2015-3113", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2015-3113"}, {"name": "comment", "value": "This heap-based buffer overflow vulnerability is exploited by having a user open a maliciously-crafted file. \n\nIn the wild, this exploitation has been used in order to establish command and control (over HTTP) with a target system.  The command and control functionality has also been seen to employ debugging/sandboxing evasion."}, {"divider": true}, {"name": "control", "value": "CVE-2022-42475"}, {"name": "comment", "value": "CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP)."}]}, {"techniqueID": "T1556", "score": 2, "comment": " Related to: \n \u2022CVE-2020-8193\n\u2022CVE-2020-12812", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-12812"}, {"name": "comment", "value": "CVE-2020-12812 is an improper authentication vulnerability in Fortinet's FortiOS, specifically affecting the SSL VPN feature. This vulnerability allows attackers to bypass two-factor authentication under certain conditions, potentially leading to unauthorized access to sensitive systems."}, {"divider": true}, {"name": "control", "value": "CVE-2020-12812"}, {"name": "comment", "value": "CVE-2020-12812 is an improper authentication vulnerability in Fortinet's FortiOS, specifically affecting the SSL VPN feature. This vulnerability allows attackers to bypass two-factor authentication under certain conditions, potentially leading to unauthorized access to sensitive systems."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8193"}, {"name": "comment", "value": "CVE-2020-8193 is an Authorization Bypass vulnerability in Citrix ADC, Gateway, and SD-WAN WANOP Appliance in various versions allows attacker to bypass authentication mechanisms via crafted requests."}]}, {"techniqueID": "T1557", "score": 2, "comment": " Related to: \n \u2022CVE-2022-1040\n\u2022CVE-2019-5591", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2019-5591"}, {"name": "comment", "value": "CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server."}, {"divider": true}, {"name": "control", "value": "CVE-2022-1040"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine. \n\nIt was actively exploited by Chinese state-sponsored APT groups, including \"Drifting Cloud,\" to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.\n\nThis vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named \"Pacific Rim.\" This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object (\"libsophos.so\"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.\n\nThis vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.\n\nThe attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely."}]}, {"techniqueID": "T1485", "score": 3, "comment": " Related to: \n \u2022CVE-2021-39226\n\u2022CVE-2018-7600\n\u2022CVE-2021-22986", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-22986"}, {"name": "comment", "value": "CVE-2021-22986 is a remote command execution vulnerability occurring on the iControl REST interface. Impact reported by the F5 security advisory \"This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. \""}, {"divider": true}, {"name": "control", "value": "CVE-2018-7600"}, {"name": "comment", "value": "CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal\u2019s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-39226"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by both unauthenticated and authenticated adversaries via the snapshot feature in Grafana. Attackers have leveraged this vulnerability to access and manipulate snapshot data, potentially leading to unauthorized data exposure and loss. Exploitation techniques have not been publicly published. \n\nIn exploitation scenarios, adversaries can view snapshots with the lowest database key by accessing specific paths, such as /dashboard/snapshot/:key or /api/snapshots/:key. If the \"public_mode\" configuration is set to true, unauthenticated users can also delete these snapshots using the path /api/snapshots-delete/:deleteKey. This capability allows attackers to enumerate and delete snapshot data, resulting in complete data loss."}]}, {"techniqueID": "T1552", "score": 2, "comment": " Related to: \n \u2022CVE-2023-49103\n\u2022CVE-2020-5902", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-5902"}, {"name": "comment", "value": "CVE-2020-5902\u2014an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)\u2014to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, \u201cexecute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.\u201d - CISA Advisory"}, {"divider": true}, {"name": "control", "value": "CVE-2023-49103"}, {"name": "comment", "value": "This vulnerability is exploited through an unauthenticated information disclosure flaw in the Graph API extension of ownCloud. Attackers first used this vulnerability to gain initial access by targeting the /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php endpoint, which allowed them to leak sensitive information via the PHP function phpinfo. By modifying the requested URI to bypass Apache web server rewrite rules, attackers could access environment variables containing secrets, such as usernames, passwords, and license keys."}]}, {"techniqueID": "T1106", "score": 2, "comment": " Related to: \n \u2022CVE-2020-8657\n\u2022CVE-2023-1389", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-8657"}, {"name": "comment", "value": "CVE-2020-8657 identifies a security issue in EyesOfNetwork 5.3 that exposes a vulnerability in the API key implementation. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-1389"}, {"name": "comment", "value": "CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router\u2019s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices. \n"}]}, {"techniqueID": "T1584.005", "score": 2, "comment": " Related to: \n \u2022CVE-2020-25506\n\u2022CVE-2020-29557", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-25506"}, {"name": "comment", "value": "CVE-2020-25506 is a command injection vulnerability in the D-Link DNS-320 FW v2.06B01 Revision Ax system_mgr.cgi component, which can lead to remote arbitrary code execution.\n\n"}, {"divider": true}, {"name": "control", "value": "CVE-2020-29557"}, {"name": "comment", "value": "CVE-2020-29557 is a buffer overflow vulnerability  in the web interface allows attackers to achieve pre-authentication remote code execution. Unidentified threat actors are reported to have been actively exploiting it to co-opt them to a Mirai-variant botnet used for carrying out DDoS attacks, merely two days after its public disclosure. "}]}, {"techniqueID": "T1056", "score": 2, "comment": " Related to: \n \u2022CVE-2020-8195\n\u2022CVE-2020-8196", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2020-8195"}, {"name": "comment", "value": "CVE-2020-8195 is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests."}, {"divider": true}, {"name": "control", "value": "CVE-2020-8196"}, {"name": "comment", "value": "CVE-2020-8196\n is an information disclosure in Citrix ADC, Gateway, and SD-WAN WANOP Appliance which allows attacker to access sensitive information via crafted requests."}]}, {"techniqueID": "T1112", "score": 2, "comment": " Related to: \n \u2022CVE-2023-38831\n\u2022CVE-2024-26169", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2024-26169"}, {"name": "comment", "value": "This vulnerability is a zero-day exploit that \"manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WerFault.exe and set the \"Debugger\" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges.\" This vulnerability has been exploited by the Black Basta ransomware group."}, {"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}]}, {"techniqueID": "T1195.002", "score": 2, "comment": " Related to: \n \u2022CVE-2024-4978\n\u2022CVE-2021-44529", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44529"}, {"name": "comment", "value": "This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the \"csrf-magic\", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's \"nobody\" user account. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-4978"}, {"name": "comment", "value": "CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2."}]}, {"techniqueID": "T1033", "score": 1, "comment": " Related to: \n \u2022CVE-2023-22518", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-22518"}, {"name": "comment", "value": "CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery, downloading malicious payloads,  "}]}, {"techniqueID": "T1550.002", "score": 1, "comment": " Related to: \n \u2022CVE-2023-23397", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-23397"}, {"name": "comment", "value": "This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems."}]}, {"techniqueID": "T1069", "score": 1, "comment": " Related to: \n \u2022CVE-2021-44515", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44515"}, {"name": "comment", "value": "CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. "}]}, {"techniqueID": "T1087", "score": 3, "comment": " Related to: \n \u2022CVE-2023-27532\n\u2022CVE-2022-41082\n\u2022CVE-2021-44515", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44515"}, {"name": "comment", "value": "CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. "}, {"divider": true}, {"name": "control", "value": "CVE-2023-27532"}, {"name": "comment", "value": "CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}]}, {"techniqueID": "T1531", "score": 1, "comment": " Related to: \n \u2022CVE-2023-34362", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-34362"}, {"name": "comment", "value": "CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts."}]}, {"techniqueID": "T1601", "score": 1, "comment": " Related to: \n \u2022CVE-2021-44168", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44168"}, {"name": "comment", "value": "CVE-2021-44168 is an unverified update download vulnerability that can be exploited by adversaries with local access creating specifically crafted download packages. "}]}, {"techniqueID": "T1078.003", "score": 1, "comment": " Related to: \n \u2022CVE-2021-44168", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-44168"}, {"name": "comment", "value": "CVE-2021-44168 is an unverified update download vulnerability that can be exploited by adversaries with local access creating specifically crafted download packages. "}]}, {"techniqueID": "T1098.004", "score": 1, "comment": " Related to: \n \u2022CVE-2022-40684", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-40684"}, {"name": "comment", "value": "This authentication bypass vulnerability allows an adversary to create an admin ssh key via any HTTP method. "}]}, {"techniqueID": "T1049", "score": 1, "comment": " Related to: \n \u2022CVE-2022-41328", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-41328"}, {"name": "comment", "value": "CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections."}]}, {"techniqueID": "T1565.001", "score": 1, "comment": " Related to: \n \u2022CVE-2022-41328", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-41328"}, {"name": "comment", "value": "CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections."}]}, {"techniqueID": "T1037", "score": 1, "comment": " Related to: \n \u2022CVE-2022-41328", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-41328"}, {"name": "comment", "value": "CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections."}]}, {"techniqueID": "T1055", "score": 1, "comment": " Related to: \n \u2022CVE-2023-6548", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-6548"}, {"name": "comment", "value": "This vulnerability allows for authenticated (low-privilege) remote code execution via code injection."}]}, {"techniqueID": "T1134.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-4966", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-4966"}, {"name": "comment", "value": "This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens."}]}, {"techniqueID": "T1542.005", "score": 1, "comment": " Related to: \n \u2022CVE-2017-6742", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2017-6742"}, {"name": "comment", "value": "CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC\u2019s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor."}]}, {"techniqueID": "T1653", "score": 1, "comment": " Related to: \n \u2022CVE-2024-20353", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2024-20353"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices. "}]}, {"techniqueID": "T1090.001", "score": 1, "comment": " Related to: \n \u2022CVE-2021-22017", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-22017"}, {"name": "comment", "value": "The vulnerability in Rhttproxy within VMware's vCenter Server arises from an improper implementation of URI normalization. Attackers with network access to port 443 on the vCenter Server exploit this flaw by sending specially crafted requests, allowing them to bypass the proxy mechanism. This exploitation grants unauthorized access to internal endpoints, potentially exposing sensitive information."}]}, {"techniqueID": "T1588.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-34048", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-34048"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has already gained network access to the vCenter Server. The adversary sends a crafted payload to the server that has a vulnerable DCERPC protocol and causes an out-of-bounds write on the jmp rax instruction. Adversary group UNC3886 has been attributed to leveraging this vulnerability in the wild to establish a backdoor in victim vCenter servers. "}]}, {"techniqueID": "T1212", "score": 1, "comment": " Related to: \n \u2022CVE-2022-22948", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-22948"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges. "}]}, {"techniqueID": "T1059.003", "score": 4, "comment": " Related to: \n \u2022CVE-2023-42793\n\u2022CVE-2023-27532\n\u2022CVE-2021-22899\n\u2022CVE-2021-40449", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-22899"}, {"name": "comment", "value": "This vulnerability is exploited through a command injection weakness. Remote authenticated attackers leverage this vulnerability to perform arbitrary code execution on the target system via the Windows Resource Profiles Feature."}, {"divider": true}, {"name": "control", "value": "CVE-2023-42793"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass in JetBrains TeamCity, allowing remote attackers with HTTP(S) access to perform unauthorized remote code execution. This vulnerability enables attackers to gain administrative control of the TeamCity server and execute cmd.exe for various malicious activities, including downloading and executing harmful files."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27532"}, {"name": "comment", "value": "CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. "}, {"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}]}, {"techniqueID": "T1555", "score": 3, "comment": " Related to: \n \u2022CVE-2024-21893\n\u2022CVE-2023-46805\n\u2022CVE-2023-27532", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-46805"}, {"name": "comment", "value": "This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. "}, {"divider": true}, {"name": "control", "value": "CVE-2024-21893"}, {"name": "comment", "value": "This vulnerability is exploited through a Server-Side Request Forgery (SSRF) weakness in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. Attackers leverage this vulnerability to gain unauthorized access by sending a crafted request to the /dana-ws/saml.ws endpoint, which can be accessed without authentication. This manipulation allows attackers to interact with internal services, potentially enabling further exploitation by chaining with other vulnerabilities."}, {"divider": true}, {"name": "control", "value": "CVE-2023-27532"}, {"name": "comment", "value": "CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. "}]}, {"techniqueID": "T1070", "score": 3, "comment": " Related to: \n \u2022CVE-2021-45382\n\u2022CVE-2023-1389\n\u2022CVE-2022-41128", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-1389"}, {"name": "comment", "value": "CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router\u2019s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices. \n"}, {"divider": true}, {"name": "control", "value": "CVE-2021-45382"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and  IZ1H9 to cause a distributed denial of service attack. \n\nIn the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.\n\nIn the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called \"ddns.sh.\" This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41128"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who entices a user with an affected version of Windows to access a malicious server. The adversary hosts a specially crafted server share or website and convinces the user to visit it, typically through an email or chat message. The adversary then crafts a malicious Microsoft Office document that embeds a remote RTF template, which fetches HTML content rendered by Internet Explorer's JScript engine. This stealthy attack vector does not require Internet Explorer as the default browser. Once the victim opens the document and disables protected view, the adversary executes arbitrary code by triggering a type confusion error in the JScript engine. This allows the adversary to deliver malicious payloads, conduct reconnaissance, and exfiltrate data, while erasing traces of the exploit by clearing the browser cache and history. The impact on the victim includes unauthorized access to sensitive information and the potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1087.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-27532", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-27532"}, {"name": "comment", "value": "CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. "}]}, {"techniqueID": "T1053", "score": 1, "comment": " Related to: \n \u2022CVE-2023-38831", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}]}, {"techniqueID": "T1505", "score": 1, "comment": " Related to: \n \u2022CVE-2022-29303", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-29303"}, {"name": "comment", "value": "CVE-2022-29303 is a command injection vulnerability within a PHP component in the product's web server. \nReports indicate that the vulnerability have been exploited by operators of Mirai botnet malware. "}]}, {"techniqueID": "T1204", "score": 1, "comment": " Related to: \n \u2022CVE-2023-38831", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-38831"}, {"name": "comment", "value": "CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. "}]}, {"techniqueID": "T1003.008", "score": 1, "comment": " Related to: \n \u2022CVE-2024-24919", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2024-24919"}, {"name": "comment", "value": "CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. "}]}, {"techniqueID": "T1211", "score": 1, "comment": " Related to: \n \u2022CVE-2022-21999", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-21999"}, {"name": "comment", "value": "This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.\n\nThe exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\\Windows\\System32\\spool\\drivers\\x64\\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.\n\nThe vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns."}]}, {"techniqueID": "T1547.001", "score": 1, "comment": " Related to: \n \u2022CVE-2022-22047", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-22047"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user."}]}, {"techniqueID": "T1016", "score": 1, "comment": " Related to: \n \u2022CVE-2021-40449", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}]}, {"techniqueID": "T1566", "score": 4, "comment": " Related to: \n \u2022CVE-2023-36884\n\u2022CVE-2022-41128\n\u2022CVE-2021-40449\n\u2022CVE-2022-34713", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-40449"}, {"name": "comment", "value": "This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-34713"}, {"name": "comment", "value": "This vulnerability is exploited when a user is tricked by an adversary to open a maliciously crafted file either via an email or malicious website. Once the user opens the file, an adversary gains the ability to execute arbitrary code the next time the victim restarts their computer and logs in."}, {"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41128"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who entices a user with an affected version of Windows to access a malicious server. The adversary hosts a specially crafted server share or website and convinces the user to visit it, typically through an email or chat message. The adversary then crafts a malicious Microsoft Office document that embeds a remote RTF template, which fetches HTML content rendered by Internet Explorer's JScript engine. This stealthy attack vector does not require Internet Explorer as the default browser. Once the victim opens the document and disables protected view, the adversary executes arbitrary code by triggering a type confusion error in the JScript engine. This allows the adversary to deliver malicious payloads, conduct reconnaissance, and exfiltrate data, while erasing traces of the exploit by clearing the browser cache and history. The impact on the victim includes unauthorized access to sensitive information and the potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1040", "score": 1, "comment": " Related to: \n \u2022CVE-2022-1040", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-1040"}, {"name": "comment", "value": "This authentication bypass vulnerability is exploited by remote attackers via the User Portal and Webadmin components. This vulnerability allows an attacker to execute arbitrary code on the victim machine. \n\nIt was actively exploited by Chinese state-sponsored APT groups, including \"Drifting Cloud,\" to target organizations and governments across South Asia, particularly in Afghanistan, Bhutan, India, Nepal, Pakistan, and Sri Lanka. The attackers leveraged this vulnerability to deploy webshells, conduct man-in-the-middle attacks by modifying DNS responses, and intercept user credentials and session cookies from content management systems.\n\nThis vulnerability was exploited by Chinese state-sponsored threat actors as part of a broader campaign named \"Pacific Rim.\" This campaign involved multiple Chinese APT groups, including APT31, APT41, and Volt Typhoon, targeting Sophos firewalls. The backdoor PygmyGoat, a novel rootkit that takes the form of a shared object (\"libsophos.so\"), has been found to be delivered following the exploitation of this vulnerability. The use of the rootkit was observed between March and April 2022 on a government device and a technology partner, and again in May 2022 on a machine in a military hospital based in Asia.\n\nThis vulnerability was also exploited by at least two advanced persistent threat (APT) groups in a highly targeted attack campaign. The attackers used the vulnerability to place malicious files into a fixed filesystem location on affected devices, leveraging a combination of authentication bypass and command injection to execute arbitrary commands as root.\n\nThe attack involved deploying various malware families, including GoMet and Gh0st RAT, to maintain persistent access and exfiltrate sensitive data. The attackers demonstrated significant knowledge of the device firmware, using custom ELF binaries and runtime packers like VMProtect to complicate analysis. They manipulated internal commands to move and manipulate files, execute processes, and exfiltrate data. The campaign targeted network security devices, employing a two-stage attack to drop remote access tools and execute commands remotely."}]}, {"techniqueID": "T1530", "score": 1, "comment": " Related to: \n \u2022CVE-2023-22952", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}]}, {"techniqueID": "T1021.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-22952", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}]}, {"techniqueID": "T1482", "score": 2, "comment": " Related to: \n \u2022CVE-2023-22952\n\u2022CVE-2022-41082", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-22952"}, {"name": "comment", "value": "This Remote Code Execution (RCE) vulnerability is exploited by an unauthenticated attacker via a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. \n\nThis vulnerability has been exploited by threat actors to gain initial access to AWS accounts by injecting custom PHP code through the SugarCRM email templates module. Attackers leveraged misconfigurations to expand their access, obtaining long-term AWS access keys from compromised EC2 instances. They used tools like Pacu and Scout Suite to explore AWS services such as EC2, IAM, RDS, and S3, and gathered account information via AWS Organizations and Cost and Usage services. The attackers moved laterally by creating RDS snapshots and new EC2 instances, modifying security groups, and attempting to escalate privileges by logging in as the Root user. They also employed defense evasion techniques, including deploying resources in non-standard regions and intermittently stopping EC2 instances to avoid detection and minimize costs.\n\nThe exploit in question is actively being used to compromise hosts by installing a PHP-based web shell. It involves an authentication bypass against the \"/index.php\" endpoint of the targeted service. Once bypassed, the attacker obtains a cookie and sends a secondary POST request to \"/cache/images/sweet.phar\" to upload a small PNG-encoded file containing PHP code. This file acts as a web shell, allowing the execution of commands specified in the base64-encoded query argument \"c\". For example, a request like 'POST /cache/images/sweet.phar?c=\"L2Jpbi9pZA==\"' would execute the command \"/bin/id\" with the same permissions as the web service's user."}, {"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}]}, {"techniqueID": "T1569.002", "score": 1, "comment": " Related to: \n \u2022CVE-2021-35394", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-35394"}, {"name": "comment", "value": "The vulnerability in Realtek Jungle chipsets is exploited by remote, unauthenticated attackers using UDP packets to a server on port 9034, enabling remote execution of arbitrary commands. The attack involves injecting a shell command that downloads and executes a shell script on the compromised device. This script downloads binaries for various CPU architectures, such as ARM, MIPS, and SuperH, primarily from the Mirai malware family, turning the device into a botnet node.\n\nThe attack script connects to a malicious IP to download and execute malware, with threats mainly from Mirai, Gafgyt, and Mozi families. It also includes a new DDoS botnet called RedGoBot, developed in Golang. The script uses wget and curl to download botnet clients for different processor architectures. RedGoBot can perform DDoS attacks on various protocols, including HTTP, ICMP, TCP, UDP, VSE, and OpenVPN, upon receiving commands from the threat operator. Additionally, injected commands can write binary payloads to files for execution or reboot the targeted server to cause denial of service."}]}, {"techniqueID": "T1036", "score": 2, "comment": " Related to: \n \u2022CVE-2022-26501\n\u2022CVE-2022-26500", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-26500"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.\n\nThis vulnerability has been exploited by threat actors associated with AvosLocker ransomware, as identified by Kroll analysts. These actors have developed new tactics targeting backup systems, specifically leveraging vulnerabilities in Veeam Backup and Replication software (CVE-2022-26500 and CVE-2022-26501) to potentially exfiltrate data while evading detection."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26501"}, {"name": "comment", "value": "This vulnerability is exploited by a remote, unauthenticated attacker to access internal API functions and send malicious code to the Veeam Distribution Service via the default TCP port 9380.\n\nThis vulnerability has been exploited by threat actors associated with the AvosLocker ransomware. Kroll analysts have observed these actors using this vulnerability, alongside CVE-2022-26500, to potentially exfiltrate data and download malicious tools while appearing as legitimate activity to evade detection."}]}, {"techniqueID": "T1499.002", "score": 2, "comment": " Related to: \n \u2022CVE-2021-45382\n\u2022CVE-2022-26258", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-45382"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and  IZ1H9 to cause a distributed denial of service attack. \n\nIn the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.\n\nIn the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called \"ddns.sh.\" This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets."}, {"divider": true}, {"name": "control", "value": "CVE-2022-26258"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an adversary via HTTP POST to get set ccp. The exploit targets a command injection vulnerability in the /lan.asp component. The component does not successfully sanitize the value of the HTTP parameter DeviceName, which in turn can lead to arbitrary command execution. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called MooBot to cause a distributed denial of service attack. "}]}, {"techniqueID": "T1071", "score": 1, "comment": " Related to: \n \u2022CVE-2021-45382", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-45382"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and  IZ1H9 to cause a distributed denial of service attack. \n\nIn the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.\n\nIn the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called \"ddns.sh.\" This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets."}]}, {"techniqueID": "T1543", "score": 1, "comment": " Related to: \n \u2022CVE-2021-45382", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2021-45382"}, {"name": "comment", "value": "This remote command execution vulnerability is exploited by an unauthenticated, remote adversary via the DDNS function in ncc2 binary file. Adversaries have leveraged this vulnerability to spread a variant of Mirai botnet called Beastmode and  IZ1H9 to cause a distributed denial of service attack. \n\nIn the IZ1H9 attack, once the attackers took advantage of the vulnerability, they injected the IZ1H9 payload into the device. This program included instructions to download another script from a specific web address. When this script ran, it erased records to cover up the malicious actions and then downloaded additional software designed for different types of devices. The script also changed the device's settings to block certain network connections, making it more difficult to remove the malware. After these steps, the infected device connected to a control server, waiting for instructions on which type of denial-of-service attack to carry out, such as disrupting services using various internet protocols.\n\nIn the Beastmode attack, exploiting the vulnerability led to the download and execution of a script called \"ddns.sh.\" This script then fetched the Beastmode program, which was saved and run with specific settings. These settings allowed the infected device to join a subgroup within the larger botnet, helping the attackers manage and assess the effectiveness of their exploits. Once devices were compromised by Beastmode, the botnet could be used to launch various types of denial-of-service attacks, similar to those seen in other Mirai-based botnets."}]}, {"techniqueID": "T1489", "score": 1, "comment": " Related to: \n \u2022CVE-2023-36884", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1490", "score": 1, "comment": " Related to: \n \u2022CVE-2023-36884", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1070.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-36884", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1553.005", "score": 1, "comment": " Related to: \n \u2022CVE-2023-36884", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-36884"}, {"name": "comment", "value": "This remote code execution vulnerability in Microsoft Office has been exploited by adversarial groups to distribute ransomware. Attackers use specially crafted Microsoft Office documents to bypass security features, enabling remote code execution without user prompts. These documents are typically delivered through phishing techniques, enticing victims to open them. Once opened, the ransomware encrypts files and demands a ransom for decryption, while also removing system backups and leaving a ransom note threatening data loss if recovery is attempted without the provided decryptor key.\n\nThe ransomware further erases system logs and may publish stolen data on leak websites, leading to unauthorized access to sensitive information and potential installation of backdoors for further exploitation. Microsoft addressed this vulnerability in their security updates by introducing measures to make file paths unpredictable, thereby mitigating the exploit chain. Despite these updates, additional vulnerabilities in Microsoft Office and Windows were identified. Security solutions offer protection against these exploits, and findings are shared with cybersecurity alliances to enhance collective defense efforts.\n\nThis vulnerability has been exploited by the Russian group Storm-0978, also known as RomCom, who craft specially designed Microsoft Office documents related to the Ukrainian World Congress. These documents bypass Microsoft's Mark-of-the-Web (MotW) security feature, enabling remote code execution without security prompts. The adversary used phishing techniques to deliver these documents, enticing victims to open them. Once opened, the ransomware, known as Underground, executes, encrypting files and demanding a ransom for decryption.\n\nThe ransomware further removes shadow copies, terminates MS SQL Server services, and leaves a ransom note threatening data loss if recovery is attempted without their decryptor key. It also erases Windows Event logs and publishes stolen victim data on a data leak website, causing unauthorized access to sensitive information and potential installation of backdoors for further exploitation."}]}, {"techniqueID": "T1567", "score": 1, "comment": " Related to: \n \u2022CVE-2022-41082", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}]}, {"techniqueID": "T1059.001", "score": 1, "comment": " Related to: \n \u2022CVE-2022-41082", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}, {"divider": true}, {"name": "control", "value": "CVE-2022-41082"}, {"name": "comment", "value": "This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration. "}]}, {"techniqueID": "T1571", "score": 1, "comment": " Related to: \n \u2022CVE-2023-38035", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}]}, {"techniqueID": "T1018", "score": 1, "comment": " Related to: \n \u2022CVE-2023-38035", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}]}, {"techniqueID": "T1557.001", "score": 1, "comment": " Related to: \n \u2022CVE-2023-38035", "metadata": [{"divider": true}, {"name": "control", "value": "CVE-2023-38035"}, {"name": "comment", "value": "This vulnerability was exploited by unauthenticated actors who accessed the System Manager Portal of Ivanti MobileIron Sentry via port 8433, leveraging an authentication bypass flaw to achieve remote code execution. This flaw allows attackers to access sensitive APIs, enabling them to change configurations, execute system commands, or write files onto the system. \n\nThis vulnerability was part of a campaign involving cryptocurrency mining and internal network reconnaissance. The exploitation allowed attackers to deploy malicious tools and conduct unauthorized activities within the network, ultimately compromising system integrity and security.The exploitation facilitated unauthorized access to the Ivanti Sentry server, allowing the execution of OS commands as a system administrator using \"sudo.\" Observations revealed that suspicious SSL connections over port 8433 led to HTTP GET requests, indicating the abuse of command-line utilities like wget and cURL. "}]}], "gradient": {"colors": ["#ffe766", "#ffaf66"], "minValue": 1, "maxValue": 127}}