SOC335-CVE-2024-49138-Exploitation-Detected

SOC335 - CVE-2024-49138 익스플로잇 탐지 개요 이것은 제가 LetsDefend에서 수행한 SOC 실습 중 하나였습니다. 경보는 CVE-2024-49138에 관한 것이었습니다. 저는 경보를 조사하고, 의심스러운 해시를 VirusTotal에서 확인했으며, 관련 활동에 대해 사용 가능한 로그를 검색했습니다. 수행한 작업 초기 경보 조사 의심스러운 해시 추출 및 VirusTotal에서 확인 LetsDefend Log Management 확인 의심스러운 파일 및 프로세스 조사 관련 IP 주소 및 네트워크 활동 확인 활...

Querying Windows Event Logs for Faster Investigation and Response

With this week’s release on the VMware Carbon Black Cloud, users can now remotely inspect Windows devices’ event logs to pull back information that could be helpful during an investigation or response scenario. This new capability comes as part of an update to the Live Query functionality provide...

DEBIAN-CVE-2013-1430

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file /.vnc/sesman$usernamepasswd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key...

CVE-2013-1430

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file /.vnc/sesman$usernamepasswd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key...

UBUNTU-CVE-2013-1430

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file /.vnc/sesman$usernamepasswd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key...

Sticky Keys Persistence Module

This module makes it possible to apply the 'sticky keys' hack to a session with appropriate rights. The hack provides a means to get a SYSTEM shell using UI-level interaction at an RDP login screen or via a UAC confirmation dialog. The module modifies the Debug registry setting for certain...