letsdefend-cve-2024-49138-investigation

LetsDefend Investigation: CVE-2024-49138 🔍 Overview Hands-on SOC investigation and incident response simulation using LetsDefend, focused on a real-world exploitation of CVE-2024-49138 — a privilege escalation vulnerability in Windows CLFS driver. 📅 Event Details Event ID : 313 Incident Type :...

SOC335-CVE-2024-49138-Exploitation-Detected

CVE-2024-49138 エクスプロイト検出 このプロジェクトでは、LetsDefendプラットフォーム上のシミュレートされたセキュリティインシデントを調査しました。このインシデントでは、Windows Common Log File System CLFS ドライバーの特権昇格脆弱性であるCVE-2024-49138の悪用によりWindowsマシンが侵害されました。攻撃者はこの脆弱性を利用して特権を昇格させ、RDP経由でリモートアクセスを確立しました。 主な成果 特定した 異常なプロセス動作を通じてCVE-2024-49138の悪用を。 分析した 検出を回避するための偽装プロセス...

SOC335-CVE-2024-49138-Exploitation-Detected

权限提升案例 - SOC335-CVE-2024-49138-漏洞利用检测 警报概览 受影响主机名： Victor 触发进程： scohost.exe 父进程： C:\Windows\System32\WINDOWSPOWERSHELL\V1.0\powershell.exe 文件哈希： b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9 触发原因： 已识别出与该哈希相关的异常或可疑行为模式，表明可能存在 CVE-2024-49138 漏洞利用。 事件响应案例：登录失败与恶意软件调查...

CVE-2024-49138-SOC-Investigation

CVE-2024-49138 漏洞利用调查 平台： LetsDefend SOC 培训环境 警报： SOC335 - 检测到 CVE-2024-49138 漏洞利用 类别： 权限提升 | 恶意软件分析 | 事件响应 状态： 调查完成 ✅ 概述 在此次调查中，我处理了一条涉及 Windows 终端上疑似利用 CVE-2024-49138 漏洞的警报。 该警报最初指向一个名为 svohost.exe 的进程的可疑活动。我没有仅依赖警报本身，而是从查看进程详情、父进程、命令行、文件位置、哈希值以及受影响主机周边的活动开始着手。...

SOC-Investigation-CVE-2024-49138

🛡️ SOC 调查报告：CVE-2024-49138 漏洞利用 📌 执行摘要 警报标题： SOC335 - 检测到 CVE-2024-49138 漏洞利用 严重性： 高 目标主机： Victor（172.16.17.207） 操作系统： Windows 10 主要用户： letsdefend 判定结果： 真阳性（已确认恶意活动） 🔍 调查方法 1. 进程与二进制分析 可疑文件： svohost.exe 执行路径： C:\temp\serviceinstaller\svohost.exe 异常情况： 进程伪装： 文件名仿冒合法的 Windows 系统文件 svchost.exe。 路径位置：...

CVE-2024-49138

此存储库没有 README。...

SOC335-CVE-2024-49138-Investigation

SOC335 – CVE-2024-49138 漏洞利用调查 概述 本项目记录了使用 LetsDefend 平台对 CVE-2024-49138 漏洞利用警报进行 SOC 调查的过程。调查涉及分析网络日志、研究入侵指标、判断是否发生了可疑通信，以及对受影响端点进行遏制。 警报详情 警报： SOC335 – 检测到 CVE-2024-49138 漏洞利用 严重性： 中 事件 ID： 313 类别： 权限提升 受影响主机： Victor 内部 IP： 172.16.17.207 可疑外部 IP： 185.107.56.141 警报截图 调查 1. 日志分析...

Microsoft Windows 11 23h2 - CLFS.sys Elevation of Privilege

Exploit Title: Microsoft Windows 11 23h2 - CLFS.sys Elevation of Privilege Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ CVE: CVE-2024-49138 include...

The Elevation of Privilege – Windows Common Log File System Driver (CVE-2024-49138) has become more critical

The Elevation of Privilege - Windows Common Log File System Driver CVE-2024-49138 has become more critical. Just as I wrote that nothing had been heard about this vulnerability for a month since it was first published in Microsoft's December Patch Tuesday, a public exploit for it appeared on...

What has become known about the Elevation of Privilege – Windows Common Log File System Driver (CVE-2024-49138) vulnerability from the December Microsoft Patch Tuesday a month later?

What has become known about the Elevation of Privilege - Windows Common Log File System Driver CVE-2024-49138 vulnerability from the December Microsoft Patch Tuesdaya month later? Almost nothing. This is a vulnerability in a standard Windows component, available in all versions starting with...

Exploit for Heap-based Buffer Overflow in Microsoft

CVE-2024-49138-POC Proof of Concept that exploits CVE-2024-4...

CVE-2024-49138

Windows Common Log File System Driver Elevation of Privilege Vulnerability Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability

Microsoft closed out its Patch Tuesday updates for 2024 with fixes for a total of 72 security flaws spanning its software portfolio, including one that it said has been exploited in the wild. Of the 72 flaws, 17 are rated Critical, 54 are rated Important, and one is rated Moderate in severity...

Patch Tuesday - December 2024

Microsoft is addressing 70 vulnerabilities this December 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and public disclosure for one of the vulnerabilities published today, and this is reflected in a CISA KEV entry. For the third month in a row, Microsoft has published...

CVE-2024-49138 Windows Common Log File System Driver Elevation of Privilege Vulnerability

...

CVE-2024-49138

Summary (CVE-2024-49138): A heap-based buffer overflow in the Windows Common Log File System Driver (CLFS.sys) enables local Elevation of Privilege on Windows 11/23h2 (and other supported builds). Public PoCs and exploits exist (GitHub PoC repos and exploits referenced in multiple sources), with ...

CVE-2024-49138

creationtimestamp| type| source ---|---|--- 2024-12-10 17:33:56+00:00| seen| https://www.thezdi.com/blog/2024/12/10/the-december-2024-security-update-review 2024-12-10 17:58:30+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113629823630772527 2024-12-10 19:22:31+00:00| seen|...