CVE-2022-38031

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

CVE-2022-37982

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

CVE-2022-37971

Microsoft Windows Defender Elevation of Privilege Vulnerability...

CVE-2022-37971

Microsoft Windows Defender Elevation of Privilege Vulnerability...

CVE-2022-37971

Microsoft Windows Defender Elevation of Privilege Vulnerability...

Privilege escalation

Microsoft Windows Defender Elevation of Privilege Vulnerability...

Microsoft Windows Defender Elevation of Privilege Vulnerability

...

CVE-2022-37971 Microsoft Windows Defender Elevation of Privilege Vulnerability

...

Microsoft Windows Defender 安全漏洞

Microsoft Windows Defender is a suite of antivirus software that comes with Windows systems from Microsoft USA. A security vulnerability exists in Microsoft Windows Defender. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the vendor's announcement...

PT-2022-5633 · Microsoft · Malware Protection Engine +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Defender affected versions not specified Description: The issue is related to the Microsoft Malware Protection Engine MPE and is associated with insufficient access control. Exploitation of this issue may allow an attacker t...

CVE-2022-37971

CVE-2022-37971 is a Windows Defender elevation-of-privilege vulnerability in the Malware Protection Engine. It allows a local attacker with low privileges and no user interaction to potentially obtain SYSTEM-level privileges on the host. The CVSSv3.1 score is 7.1 (LP: local, IL: high, AI: high). ...

PT-2022-5497 · Microsoft · Wdac Ole Db Provider For Sql Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft WDAC OLE DB provider for SQL Server affected versions not specified Description: The issue is related to incorrect code generation management in the Microsoft WDAC OLE DB provider for SQL Server. It allows remote attackers to execut...

Detecting and preventing LSASS credential dumping attacks

Obtaining user operating system OS credentials from a targeted device is among threat actors’ primary goals when launching attacks because these credentials serve as a gateway to various objectives they can achieve in their target organization’s environment, such as lateral movement. One techniqu...

Detecting and preventing LSASS credential dumping attacks

Obtaining user operating system OS credentials from a targeted device is among threat actors’ primary goals when launching attacks because these credentials serve as a gateway to various objectives they can achieve in their target organization’s environment, such as lateral movement. One techniqu...

Detecting and preventing LSASS credential dumping attacks

Obtaining user operating system OS credentials from a targeted device is among threat actors’ primary goals when launching attacks because these credentials serve as a gateway to various objectives they can achieve in their target organization’s environment, such as lateral movement. One techniqu...

Detecting and preventing LSASS credential dumping attacks

Obtaining user operating system OS credentials from a targeted device is among threat actors’ primary goals when launching attacks because these credentials serve as a gateway to various objectives they can achieve in their target organization’s environment, such as lateral movement. One techniqu...

PT-2022-14862 · Undefined · Undefined

ParsedReport 01-10-2022 Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082 https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082 Threats: Chinachopper Backdoor:win32/rewritehttp...

Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082

October 1, 2022 update – Added information about Exploit:Script/ExchgProxyRequest.A, Microsoft Defender AV’s robust detection for exploit behavior related to this threat. We also removed a section on MFA as a mitigation, which was included in a prior version of this blog as standard guidance...

ZINC weaponizing open-source software

In recent months, Microsoft has detected a wide range of social engineering campaigns using weaponized legitimate open-source software by an actor we track as ZINC. Microsoft Threat Intelligence Center MSTIC observed activity targeting employees in organizations across multiple industries includi...

New Windows 11 security features are designed for hybrid work

Attackers are constantly evolving, becoming increasingly sophisticated and destructive—the median time for an attacker to access your private data if you fall victim to a phishing email is 1 hour, 12 minutes.1 Microsoft tracks more than 35 ransomware families and more than 250 unique nation-state...