MiniPlasma-Detection

MiniPlasma Detection CVE-2020-17103 Sigma detection rule for MiniPlasma, a Windows local privilege escalation exploit abusing a race condition in cldflt.sys to hijack the windir environment variable for the SYSTEM account, redirecting the WER QueueReporting scheduled task to execute an attacker...

Exploit for Improper Privilege Management in Microsoft

MiniPlasma Detection CVE-2020-17103 Sigma detection rule fo...

CVE-2020-28369

In BeyondTrust Privilege Management for Windows aka PMfW through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp...

Buffer overflow

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

CVE-2019-17093

An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process PPL and might bypass some of the self-defense mechanisms. This affects...

Necurs Rootkit infect 83,427 machines in November

Rootkit named as "Necurs" infect 83,427 unique machines during the month of November 2012. It is a multi-purpose rootkits capable of posing a threat to both 32 and 64-bit Windows systems. Distributed via drive-by download on the websites that host the BlackHole exploit kit. Like other rootkits it...