resource center

Threat Intelligence
Resources

BOOK DEMO >
SUBSCRIBE >

Threat SnapShots

You've heard of "Patch Tuesday" and "Exploit Wednesday". In this "Thursday Threat SnapShot", we'll take a closer look at a local privilege escalation vulnerability affecting the Ancillary Function Driver for WinSock (afd.sys) in Windows 11 and Server 2022 systems. This vulnerability, tracked as CVE-2023-21768, was patched in January of this year, but attackers have reverse engineered the patch and created working exploits for it, which have been seen in the wild. We'll take a look at a POC created by IBM's X-Force Red and discuss detection and threat hunting strategies you can use to protect your organization. References: - https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/ - https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768 SnapAttack Content: - https://app.snapattack.com/threat/c4ea07f2-b9f5-568b-9196-c2c53313eac5 - Threat: Windows 11 Ancillary Function Driver Elevation of Privilege (CVE-2023-21768) - https://app.snapattack.com/detection/cdcb08c8-046a-4456-a2e3-b2a7abd1cbdb - Detection: CVE-2023-21768 IoRing Pipe Names - https://app.snapattack.com/detection/702b193e-2cbb-422c-be76-6cb6056b3987 - Detection: Suspicious SeProfileSingleProcessPrivilege
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLi16UTBjX2FsMjU0

Hunting for Local Privilege Escalation via CVE-2023-21768 | Threat SnapShot

03/23/23

In this week's Threat SnapShot, we'll take a look at a privilege escalation attack affecting Microsoft Outlook that has been used by a Russian nation-state actor (APT28, Fancy Bear, GRU) against organizations in Ukraine. The vulnerability, CVE-2023-23397, was addressed in Microsoft's most recent patch Tuesday (March 2023). Evidence of exploitation, however, has been seen to date back to at least April 2022. The attack leverages a relatively obscure feature of Outlook, where calendar invites can contain a file path for an alternative notification sound. An attacker can specify a UNC path, and Outlook will happily pass along the user's NTLM credentials to try to authenticate to that path, leading to an escalation of privilege and credential compromise. We'll take a closer look at three example attack variations using this vulnerability -- one that passes the credentials via WebDAV, another that relays the NTLM credentials to gain an SMB shell on the victim, and a third that uses this vulnerability as a persistence mechanism by setting a registry key. We'll also discuss detection and threat hunting strategies to protect your organization from each of these attack vectors. Resources: - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/ - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/ - https://twitter.com/ACEResponder/status/1636116096506818562 - https://posts.bluraven.io/detecting-ntlm-relay-attacks-d92e99e68fb9 - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/ SnapAttack Content: - https://app.snapattack.com/threat/91c4a7c4-441e-2c5d-2968-a3f8ca5d3b93 - Threat: Forcing Webdav via Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) - https://app.snapattack.com/detection/2bd7b343-027d-4e6a-b556-89893cfbf5a0 - Detection: Suspicious WebDav Client Execution - https://app.snapattack.com/threat/9d2ae2f2-1b47-deed-387f-52d1abfc4f0a - Threat: NTLM Relay via Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) - https://app.snapattack.com/threat/ab87870c-443a-8c49-24d8-63aab29e6749 - Threat: Persistence via Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) - https://app.snapattack.com/detection/ce6482ed-d747-4b13-87a1-7f4b5dbdae1a - Detection: CVE-2023-23397 via Registry
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLllVYWhha25wS1VZ

Russian Malicious Outlook Calendar Invites Targeting Ukraine (CVE-2023-23397) | Threat SnapShot

03/17/23

In this week's Threat SnapShot, we're discussing everyone's favorite Office application -- Word (sorry Excel and PowerPoint)! First, we'll look at the CVE-2023-21716, a remote code execution vulnerability in Microsoft Word that has a CVSS score of 9.8. This vulnerability affects rich text format (RTF) documents that have an exceptionally large font table, which can cause a heap overflow. We'll demonstrate the proof-of-concept exploit released by the original reporter, and discuss some likely detection strategies for this threat. Next, we'll dive into the new Emotet campaign that is using a 500 MB Word document as the initial infection vector, and discuss threat hunting and detection opportunities you can use in your organization today. References: - https://www.cyberkendra.com/2023/03/researchers-released-ms-office-zero-day.html - https://twitter.com/jduck/status/1632471544935923712 - https://www.darkreading.com/threat-intelligence/emotet-resurfaces-yet-again-after-three-month-hiatus - https://twitter.com/Max_Mal_/status/1633102894328168448 SnapAttack Content: - https://app.snapattack.com/intelligence/c34371ed-6d6b-475a-a574-3673032fccaf - Intelligence: Researchers Released MS Office Zero-Day Vulnerability Details and Exploit Code - https://app.snapattack.com/threat/8f5a7a52-0da4-393c-e32b-5547aa3aca97 - Threat: Microsoft Word’s RTF Heap Corruption (CVE-2023-21716) - https://app.snapattack.com/detection/6d672c6d-6a1d-4035-800d-42b2b5897c23 - Detection: Microsoft Office Product Spawning Windows Shell - https://app.snapattack.com/detection/c809cf76-1919-4f30-853f-679426873b31 - Detection: Created Files by Office Applications - https://app.snapattack.com/detection/575afa6b-f46a-49c8-ab19-6ac1ce8b8eb3 - Detection: Microsoft Office spawning script interpreter - https://app.snapattack.com/intelligence/9a367cf3-5c7a-48ae-917a-f7ebf3620ebb - Intelligence: Emotet Resurfaces Yet Again After 3-Month Hiatus - https://app.snapattack.com/threat/47c7fa7c-b536-01e0-8c1c-60caa92a1774 - Threat: Emotet - Inflated Document and DLL Campaign - https://app.snapattack.com/detection/b3123391-b0b8-40f5-8a7a-87dcb4cc8fb6 - Detection: Unsigned DLLs loaded from rundll32 regsvr32 from non-standard directories - https://app.snapattack.com/detection/0b637cf0-fdd4-4838-bfd7-e83b4fe6245e - Detection: Suspicious File Create by regsvr32 - https://app.snapattack.com/detection/2e5505fc-0d05-4a1c-a32e-97699bf734c4 - Detection: Regsvr32 Anomaly - https://app.snapattack.com/detection/c809cf76-1919-4f30-853f-679426873b31 - Detection: Created Files by Office Applications - https://app.snapattack.com/detection/a41e4f07-f49e-477e-8e95-d969d053edf8 - Detection: Emotet Traffic Pattern - https://app.snapattack.com/detection/2a8e6fb6-899f-445d-8fa4-988729503379 - Detection: Legitimate Application Dropped Archive
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLkdpVDhNdV9Id3Mw

Hunting for MS Word 0-Day (CVE-2023-21716) and New Emotet Campaign | Threat SnapShot

03/09/23

Qakbot (Qbot) has been around for over a decade, and can routinely be found on lists of the most common malware infections. From the attacker's perspective, a lot of this success can be attributed to rapidly changing their TTPs to avoid detection, packaging their malware in new and novel ways to evade anti-virus, EDR, and SIEM detections rules. In this week's SnapShot, we'll take a look at a recent Qakbot sample, highlight some of their evasion strategies (like adding multiple backslashes to file paths), and discuss detection and hunting strategies you can use to keep ahead of their ever changing techniques. References: - https://www.avertium.com/resources/threat-reports/a-closer-look-at-qakbot - https://www.cisa.gov/resources-tools/resources/qbotqakbot-malware - https://twitter.com/pr0xylife/status/1630274058725072899 SnapAttack Content: - https://app.snapattack.com/threat/43800c7a-a9e5-40b4-00e3-66f070b2f3d6 - Threat: Qakbot - HTML Infection Chain - https://app.snapattack.com/detection/e6328038-4ff8-4e11-b2ad-decebe593d59 - Detection: Suspicious Invoke-WebRequest Usage (ScriptBlockText) - https://app.snapattack.com/detection/c80416cf-2e42-41c0-8205-94b6b5325e62 - Detection: Suspicious Copy From or To System32 - https://app.snapattack.com/detection/85a2ae02-7f4c-4a17-bd40-0e192d37757c - Detection: Possible Script Execution from ISO
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLlZPa1Y1S1RLOU9B

Detecting QAKBOT/QBOT Malicious Activity

03/03/23

Load More... Subscribe

Threat SnapShots

You've heard of "Patch Tuesday" and "Exploit Wednesday". In this "Thursday Threat SnapShot", we'll take a closer look at a local privilege escalation vulnerability affecting the Ancillary Function Driver for WinSock (afd.sys) in Windows 11 and Server 2022 systems. This vulnerability, tracked as CVE-2023-21768, was patched in January of this year, but attackers have reverse engineered the patch and created working exploits for it, which have been seen in the wild. We'll take a look at a POC created by IBM's X-Force Red and discuss detection and threat hunting strategies you can use to protect your organization. References: - https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/ - https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768 SnapAttack Content: - https://app.snapattack.com/threat/c4ea07f2-b9f5-568b-9196-c2c53313eac5 - Threat: Windows 11 Ancillary Function Driver Elevation of Privilege (CVE-2023-21768) - https://app.snapattack.com/detection/cdcb08c8-046a-4456-a2e3-b2a7abd1cbdb - Detection: CVE-2023-21768 IoRing Pipe Names - https://app.snapattack.com/detection/702b193e-2cbb-422c-be76-6cb6056b3987 - Detection: Suspicious SeProfileSingleProcessPrivilege
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLi16UTBjX2FsMjU0

Hunting for Local Privilege Escalation via CVE-2023-21768 | Threat SnapShot

03/23/23

In this week's Threat SnapShot, we'll take a look at a privilege escalation attack affecting Microsoft Outlook that has been used by a Russian nation-state actor (APT28, Fancy Bear, GRU) against organizations in Ukraine. The vulnerability, CVE-2023-23397, was addressed in Microsoft's most recent patch Tuesday (March 2023). Evidence of exploitation, however, has been seen to date back to at least April 2022. The attack leverages a relatively obscure feature of Outlook, where calendar invites can contain a file path for an alternative notification sound. An attacker can specify a UNC path, and Outlook will happily pass along the user's NTLM credentials to try to authenticate to that path, leading to an escalation of privilege and credential compromise. We'll take a closer look at three example attack variations using this vulnerability -- one that passes the credentials via WebDAV, another that relays the NTLM credentials to gain an SMB shell on the victim, and a third that uses this vulnerability as a persistence mechanism by setting a registry key. We'll also discuss detection and threat hunting strategies to protect your organization from each of these attack vectors. Resources: - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/ - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/ - https://twitter.com/ACEResponder/status/1636116096506818562 - https://posts.bluraven.io/detecting-ntlm-relay-attacks-d92e99e68fb9 - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/ SnapAttack Content: - https://app.snapattack.com/threat/91c4a7c4-441e-2c5d-2968-a3f8ca5d3b93 - Threat: Forcing Webdav via Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) - https://app.snapattack.com/detection/2bd7b343-027d-4e6a-b556-89893cfbf5a0 - Detection: Suspicious WebDav Client Execution - https://app.snapattack.com/threat/9d2ae2f2-1b47-deed-387f-52d1abfc4f0a - Threat: NTLM Relay via Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) - https://app.snapattack.com/threat/ab87870c-443a-8c49-24d8-63aab29e6749 - Threat: Persistence via Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) - https://app.snapattack.com/detection/ce6482ed-d747-4b13-87a1-7f4b5dbdae1a - Detection: CVE-2023-23397 via Registry
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLllVYWhha25wS1VZ

Russian Malicious Outlook Calendar Invites Targeting Ukraine (CVE-2023-23397) | Threat SnapShot

03/17/23

In this week's Threat SnapShot, we're discussing everyone's favorite Office application -- Word (sorry Excel and PowerPoint)! First, we'll look at the CVE-2023-21716, a remote code execution vulnerability in Microsoft Word that has a CVSS score of 9.8. This vulnerability affects rich text format (RTF) documents that have an exceptionally large font table, which can cause a heap overflow. We'll demonstrate the proof-of-concept exploit released by the original reporter, and discuss some likely detection strategies for this threat. Next, we'll dive into the new Emotet campaign that is using a 500 MB Word document as the initial infection vector, and discuss threat hunting and detection opportunities you can use in your organization today. References: - https://www.cyberkendra.com/2023/03/researchers-released-ms-office-zero-day.html - https://twitter.com/jduck/status/1632471544935923712 - https://www.darkreading.com/threat-intelligence/emotet-resurfaces-yet-again-after-three-month-hiatus - https://twitter.com/Max_Mal_/status/1633102894328168448 SnapAttack Content: - https://app.snapattack.com/intelligence/c34371ed-6d6b-475a-a574-3673032fccaf - Intelligence: Researchers Released MS Office Zero-Day Vulnerability Details and Exploit Code - https://app.snapattack.com/threat/8f5a7a52-0da4-393c-e32b-5547aa3aca97 - Threat: Microsoft Word’s RTF Heap Corruption (CVE-2023-21716) - https://app.snapattack.com/detection/6d672c6d-6a1d-4035-800d-42b2b5897c23 - Detection: Microsoft Office Product Spawning Windows Shell - https://app.snapattack.com/detection/c809cf76-1919-4f30-853f-679426873b31 - Detection: Created Files by Office Applications - https://app.snapattack.com/detection/575afa6b-f46a-49c8-ab19-6ac1ce8b8eb3 - Detection: Microsoft Office spawning script interpreter - https://app.snapattack.com/intelligence/9a367cf3-5c7a-48ae-917a-f7ebf3620ebb - Intelligence: Emotet Resurfaces Yet Again After 3-Month Hiatus - https://app.snapattack.com/threat/47c7fa7c-b536-01e0-8c1c-60caa92a1774 - Threat: Emotet - Inflated Document and DLL Campaign - https://app.snapattack.com/detection/b3123391-b0b8-40f5-8a7a-87dcb4cc8fb6 - Detection: Unsigned DLLs loaded from rundll32 regsvr32 from non-standard directories - https://app.snapattack.com/detection/0b637cf0-fdd4-4838-bfd7-e83b4fe6245e - Detection: Suspicious File Create by regsvr32 - https://app.snapattack.com/detection/2e5505fc-0d05-4a1c-a32e-97699bf734c4 - Detection: Regsvr32 Anomaly - https://app.snapattack.com/detection/c809cf76-1919-4f30-853f-679426873b31 - Detection: Created Files by Office Applications - https://app.snapattack.com/detection/a41e4f07-f49e-477e-8e95-d969d053edf8 - Detection: Emotet Traffic Pattern - https://app.snapattack.com/detection/2a8e6fb6-899f-445d-8fa4-988729503379 - Detection: Legitimate Application Dropped Archive
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLkdpVDhNdV9Id3Mw

Hunting for MS Word 0-Day (CVE-2023-21716) and New Emotet Campaign | Threat SnapShot

03/09/23

Qakbot (Qbot) has been around for over a decade, and can routinely be found on lists of the most common malware infections. From the attacker's perspective, a lot of this success can be attributed to rapidly changing their TTPs to avoid detection, packaging their malware in new and novel ways to evade anti-virus, EDR, and SIEM detections rules. In this week's SnapShot, we'll take a look at a recent Qakbot sample, highlight some of their evasion strategies (like adding multiple backslashes to file paths), and discuss detection and hunting strategies you can use to keep ahead of their ever changing techniques. References: - https://www.avertium.com/resources/threat-reports/a-closer-look-at-qakbot - https://www.cisa.gov/resources-tools/resources/qbotqakbot-malware - https://twitter.com/pr0xylife/status/1630274058725072899 SnapAttack Content: - https://app.snapattack.com/threat/43800c7a-a9e5-40b4-00e3-66f070b2f3d6 - Threat: Qakbot - HTML Infection Chain - https://app.snapattack.com/detection/e6328038-4ff8-4e11-b2ad-decebe593d59 - Detection: Suspicious Invoke-WebRequest Usage (ScriptBlockText) - https://app.snapattack.com/detection/c80416cf-2e42-41c0-8205-94b6b5325e62 - Detection: Suspicious Copy From or To System32 - https://app.snapattack.com/detection/85a2ae02-7f4c-4a17-bd40-0e192d37757c - Detection: Possible Script Execution from ISO
YouTube Video VVVpNUthYVIwdExVbXg1d290cG5XajhnLlZPa1Y1S1RLOU9B

Detecting QAKBOT/QBOT Malicious Activity

03/03/23

Load More... Subscribe