MiniPlasma-Detection

MiniPlasma 検出 CVE-2020-17103 cldflt.sys の競合状態を悪用して SYSTEM アカウントの windir 環境変数を乗っ取り、WER QueueReporting スケジュールタスクをリダイレクトして攻撃者制御のバイナリを SYSTEM として実行させる Windows ローカル特権昇格エクスプロイト MiniPlasma の Sigma 検出ルール。 CVE-2020-17103 は 2020 年に Google Project Zero の James Forshaw によって報告され、Microsoft によって修正されたとされています。202...

Exploit for Improper Privilege Management in Microsoft

MiniPlasma Detection CVE-2020-17103 Sigma detection rule fo...

CVE-2020-28369

In BeyondTrust Privilege Management for Windows aka PMfW through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp...

Buffer overflow

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

CVE-2019-17093

An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process PPL and might bypass some of the self-defense mechanisms. This affects...

Necurs Rootkit infect 83,427 machines in November

Rootkit named as "Necurs" infect 83,427 unique machines during the month of November 2012. It is a multi-purpose rootkits capable of posing a threat to both 32 and 64-bit Windows systems. Distributed via drive-by download on the websites that host the BlackHole exploit kit. Like other rootkits it...

CVE-2004-2713: Undefined Security Weakness

Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\ to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product...

CVE-2007-4785: Undefined Security Weakness

Sony Micro Vault Fingerprint Access Software, as distributed with Sony Micro Vault USM-F USB flash drives, installs a driver that hides a directory under %WINDIR%, which might allow remote attackers to bypass malware detection by placing files in this directory...

CVE-2006-6579: Undefined Security Weakness

Microsoft Windows XP has weak permissions FILEWRITEDATA and FILEREADDATA for Everyone for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAMmachine and read access by IUSRMachine...