CVE-2023-0400

Trellix 数据丢失防护 DLP 绕过 https://kcm.trellix.com/corporate/index?page=content&id=SB10394...

trellix-tarslip-patch-bypass

trellix-tarslip-patch-bypass 2023年，Trellix宣布1，他们为超过61,000个开源项目修补了CVE-2007-4559，这是一个旧路径遍历漏洞。分析他们的修补程序，很容易注意到可以使用符号链接绕过。 符号链接路径遍历是一种旧技术，在LiveOverflow的视频严重 .zip 漏洞？ - Zip Slip 和 ZipperDown中也展示过。 1 Trellix Advanced Research Center 修补了61,000个易受攻击的开源项目 PoC docker build -t tarslip . docker run -it tarsl...

The Bug Report – August 2026 Edition

The Bug Report – August 2026 Edition By Jonathan Omakun · September 3, 2026 Why am I here? Sharpen your pencils and pull out those fresh notebooks; we're back with the bug report! Half the world is squeezing the last drops of joy out of their summer vacations, and the other half is on the...

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

Weaponized AI: The Commoditization of Cybercrime

Weaponized AI: The Commoditization of Cybercrime By Jambul Tologonov · August 12, 2026 Executive Summary The Trellix Advanced Research Center has been actively monitoring dark web forums and criminal communication channels for emerging threats tied to artificial intelligence AI. What we are...

The vulnerability of the Trellix Endpoint Security (HX) Agent software allows a perpetrator to elevate their privileges to a system-level level.

The vulnerability of the Trellix Endpoint Security HX Agent software is related to incorrect code generation management. Exploiting this vulnerability can allow an attacker to elevate their privileges to a system-level level...

CVE-2025-7958

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details...

CVE-2025-7958

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details...

CVE-2025-7958

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details...

CVE-2025-7958

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details...

CVE-2025-7958

Summary (CVE-2025-7958): A code injection vulnerability exists in Trellix Network Security CM and NX. A locally authenticated admin user can trigger arbitrary code execution via the web interface and Alert artifact details. The issue is described as enabling remote-like control within the device ...

EUVD-2025-210348

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details...

CVE-2025-7958: Improper Control of Generation of Code

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details...

PT-2026-52689

Name of the Vulnerable Software and Affected Versions Trellix Network Security CM affected versions not specified Trellix Network Security NX affected versions not specified Description A code injection issue allows a locally authenticated admin user to execute arbitrary code via the web interfac...

Trellix Confirms Source Code Breach With Unauthorized Repository Access

Cybersecurity company Trellix has announced that it suffered a breach that enabled unauthorized access to a "portion" of its source code. It said it "recently identified" the compromise of its source code repository and that it began working with "leading forensic experts" to resolve the matter...

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense By Maulik Maheta and Chao Sun · April 14, 2026 Executive summary A DCSync attack is one of the most formidable techniques an adversary can deploy after gaining a foothold in an Active Directory AD environmen...

The Ghost SPN Attack: Catching Stealthy Kerberoasting Before It's Too Late Using Trellix NDR

The Ghost SPN Attack: Catching Stealthy Kerberoasting Before It's Too Late Using Trellix NDR By Maulik Maheta and Henry Bernabe · March 23, 2026 Executive summary As organizations adopt an identity-first security posture, adversaries are increasingly exploiting the "identity fabric” using...

CVE-2025-14963

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...

CVE-2025-14963

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...