Carbon Black’s Global Incident Response Threat Report: The Ominous Rise of “Island Hopping” & Counter Incident Response Continues

To stay abreast of the current attack landscape and to quantify the latest attack trends seen by leading IR firms, Carbon Black is publishing its third Global Incident Response Threat Report GIRTR since introducing it in July 2018. Aggregating qualitative and quantitative input from 40 Carbon Bla...

How to Mature Your Threat Hunting Program with the ATT&CK™ Framework

John Wunder, Principal Cybersecurity Engineer at MITRE spoke in a recent webinar about how the ATT&CK framework is a knowledgebase of adversary behaviors, describing the things that are tough for the adversary to change – those at the top of David J. Bianco’s influential Pyramid of Pain. Wunder...

DCOMrade - Powershell Script For Enumerating Vulnerable DCOM Applications

DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script currently...

A Vulnerability in Debian’s Apt Allows for Easy Lateral Movement in Data Centers

Learn about the new vulnerability that was found in Debian’s Advanced Package Tool that allows for easy lateral movement in data center...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

Default configuration

DISPUTED An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

CVE-2018-20735

BMC PATROL Agent (PatrolCli) up to version 11.3.01 is vulnerable to privilege escalation and potential domain-wide lateral movement. The PatrolCli/PATROL Agent authentication only validates the user password, not the user’s network permissions, enabling a low-privilege domain account to authentic...

PT-2019-10193 · Microsoft +1 · Windows Active Directory +1

Name of the Vulnerable Software and Affected Versions: BMC PATROL Agent versions through 11.3.01 Description: An issue in the BMC PATROL Agent allows for lateral movement and escalation of privilege inside a Windows Active Directory environment. The PatrolCli application only verifies if the...

Partner Perspectives: Awake Security and Carbon Black Deliver Comprehensive Threat Detection and Response

Rudolph Araujo is the Vice President of Awake Security. Even relatively unsophisticated attackers today use tools, tactics and techniques that make them difficult to uncover. For instance, the use of non-malware tools, such as PowerShell, psexec and Python, places a burden on security teams to...

3 Infosec Reflections to Kick off 2019 & Finally Shift the Balance of Power Back to Defenders

Wow. It's already 2019. Talk about a year in 2018 that flew by! I won’t spend this entire blog talking about 2018 but, needless to say, a lot happened in 2018 and it doesn’t look to slow down anytime soon. This time of year, I like to stop and reflect on the previous year and think about moving...

Exploit for CVE-2018-8581

CVE-2018-8581 This is a mailbox-level lateral penetration an...

Parlez-vous Machine?

Have you ever heard of the MQTT or CoAP protocols? No? Well the device on your wrist, and so many devices around you, could be using them right now. MQTT and CoAP are machine-to-machine or M2M protocols. With the rise of the internet of things IoT and operational technology OT, there’s increased...

Marriott breach impacts 500 million customers: here’s what to do about it

Today Marriott disclosed a large-scale data breach impacting up to 500 million customers who have stayed at a Starwood-branded hotel within the last four years. While details of the breach are still sparse, Marriott stated that there was unauthorized access to a database tied to customer...

WannaMine upgrade to V3. 0 version, the alert caught it! - Vulnerability warning-the black bar safety net

Recently, several companies feedback a large number of hosts and services, the presence of Cottonwood and blue screen phenomenon, in the quest for Sangfor assists after using EDR for the entire network scan found a large number of hosts infected by the same virus. Sangfor security team Research...

TrickBot takes over as top business threat

Last quarter brought with it a maddening number of political ads, shocking and divisive news stories on climate change and gun laws, and mosquitoes. We hate mosquitoes. In related unpleasant news, it also apparently ushered in an era of banking Trojans that, as of this moment, shows no signs of...

Time to Eliminate Traditional VPNs

It is time to stop trusting your endpoints implicitly and reduce the complexity and risk associated with traditional VPN access and flat networks. Varied digital ecosystems, cloud migration, and workforce mobility have created a climate where the network perimeter no longer exists. This is eviden...

Carbon Black Report: An Evolution of Cyberattacks

Quarterly Incident Response Threat Report An Evolution of Cyberattacks From Grab-and-Go Breaches to Long-Term Campaigns The data in this report reveals that today’s cyberattacks manifest as increasingly complex, long-term campaigns. Employing high-level tools and techniques, attackers set out to...

LuckyMouse signs malicious NDISProxy driver with certificate of Chinese IT company

What happened? Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe system process memory. These implants were injected by the digitally signed 32- and 64-bit network filtering driver NDISProxy. Interestingly, this driver is sign...