CVE-2020-7286: Improper Handling of Insufficient Privileges

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

CVE-2020-7288: Improper Handling of Insufficient Privileges

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

PT-2020-19524

Name of the Vulnerable Software and Affected Versions McAfee Exploit Detection and Response EDR for Linux versions prior to 3.1.0 Hotfix 1 Description The issue allows a malicious script or program to perform functions that the local executing user has not been granted access to. This is a result...

CVE-2020-7287: Improper Handling of Insufficient Privileges

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Linux prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

PT-2020-19525

Name of the Vulnerable Software and Affected Versions McAfee Exploit Detection and Response EDR for Mac versions prior to 3.1.0 Hotfix 1 Description The issue allows a malicious script or program to perform functions that the local executing user has not been granted access to. This is a result o...

MITRE ATT&CK Evaluation Demonstrates the Power of the VMware Carbon Black Cloud

MITRE has released the results for its latest endpoint detection and response EDR product evaluation using its now industry-standard open methodology, the ATT&CK® framework. This year’s results further demonstrate why VMware Carbon Black, now a two-time participant, is a top choice of security an...

RHEL 7 : kernel (RHSA-2020:1460)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1460 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: hardware: bluetooth: BR/EDR encryption key...

The vulnerability of the MOXA EDR-810 industrial router’s web server lies in the lack of a mechanism for filtering specific symbols, allowing attackers to execute arbitrary commands.

The vulnerability of the MOXA EDR-810 industrial router’s web server is related to the absence of a mechanism for filtering specific characters. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending specially crafted requests to the web server...

Forrester names Microsoft a Leader in 2020 Enterprise Detection and Response Wave

I’m proud to announce that Microsoft is positioned as a Leader in The Forrester Wave: Enterprise Detection and Response, Q1 2020. Among the Leaders in the report, Microsoft received the highest score in the current offering category. Microsoft also received the highest score of all participating...

Detecting Fileless Attacks with Enterprise EDR’s AMSI Visibility

If this year’s 2020 Cybersecurity Outlook Report taught us anything, it’s that defenders are seeing an increasing amount of defense evasion techniques in their environments. It’s crucial for security teams to have the granular visibility they need to spot malicious attacker behavior, however...

Evaluating EPP in the Time of XDR

The endpoint detection and response EDR market is not only more critical than ever, it is also going through the biggest period of innovation in its history – bigger than when EDR was first introduced by Carbon Black 7 years ago. This next wave of innovation is about extending EDR beyond the...

Download Guide: Advanced Threat Protection Beyond the AV

At a certain point, almost every organization reaches the conclusion that there is a need to move past just the standard AV and firewall stack in order to soundly protect their environment. The common practice in recent years is to gain extra protection through implementing either EDR\EPP solutio...

Download Guide — Advanced Threat Protection Beyond the AV

At a certain point, almost every organization reaches the conclusion that there is a need to move past just the standard AV and firewall stack in order to soundly protect their environment. The common practice in recent years is to gain extra protection through implementing either EDR\EPP solutio...

Why Our Customers Love VMware Carbon Black

As the cybersecurity world advances, organizations are starting to change their approach to security. More and more teams are moving to the cloud to maximize their endpoint protection and simplify their security stack. Using VMWare Carbon Black's Cloud platform, our customers are able to...

CB Customer Spotlight: Q&A with BraunAbility’s Arlie Hartman

BraunAbility is a mobility vehicle company committed to improving access and transportation for the world’s wheelchair community. Driven by a strong corporate culture of doing right by their customers and communities, providing advanced security has become an essential pillar of their mission...

PT-2020-1970

Name of the Vulnerable Software and Affected Versions MOXA EDR-810 affected versions not specified Description The issue is related to a lack of special character filtering mechanism in the web server of the MOXA EDR-810 industrial router. This allows a remote attacker to execute arbitrary comman...

The vulnerability of the Web GUI component of the microprogramming software for Moxa EDR-810 allows a intruder to execute arbitrary commands.

The vulnerability of the Web GUI component of the microprogramming software for Moxa EDR-810 lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created HTTP POST request...

How to Use VMware Carbon Black’s Real-Time Endpoint Query to Identify BlueKeep Vulnerability Risk

Recently, security researchers revealed a Proof of Concept attack that leverages the BlueKeep vulnerability. Whenever this type of news breaks on the twittersphere, organizations are left with the question: "Are we susceptible to this type of attack?" Using CB LiveOps, a real-time endpoint query...

SysWhispers - AV/EDR Evasion Via Direct System Calls

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to 10. Example generated files available in example-output/. Introduction Various security products place hooks in user-mode APIs which allow...

Mean Time to Hardening: The Next-Gen Security Metric

On average, it takes an organization 15 times longer to close a vulnerability than it does for attackers to weaponize and exploit one. Seven days to weaponize and 102 days to patch. Let that sink in. Once a vulnerability is disclosed, it’s you against them in a race to either secure or exploit; a...