페이지 80 | SOC Prime

Rapid7, Codecov 공급망 공격의 희생양이 되다

Posted on 18.05.202109.08.2025 by Alla Yurchenko

주요 사이버 보안 회사 Rapid7은 Codecov 공급망 공격의 과정에서 소스 코드 리포지토리의 일부가 노출되었다고 발표했습니다. 공식 성명에 따르면, 손상된 리포는 내부 인증 정보와 MDR(Managed Detection and Response) 고객을 위한 경고 관련 데이터를 포함하고 있었습니다. Codecov 공급망 공격 2021년 4월 15일, 소프트웨어 감사 회사 Codecov은 발표했습니다. 그의 Bash Uploader 스크립트가 미확인 행위자에 의해 백도어가 설치되었다고 합니다. […]

FragAttacks 감지: 새로 발견된 WiFi 결함 개요

Posted on 17.05.202109.08.2025 by Alla Yurchenko

보안 전문가들은 Wi-Fi 표준의 최근 발견된 취약점 세트로 인해 또 한 번 경계를 늦추지 않고, 커피를 많이 준비해야 할 것입니다. 이 결함들은 FragAttacks로 통칭되며, 거의 모든 무선 장치에 영향을 미치고, 적들이 취약한 시스템을 통제하여 비밀 정보를 가로채게 할 수 있습니다. 이러한 경이로운 버그를 공개한 보안 전문가 Mathy Vanhoef는 모든 Wi-Fi 제품이 최소한 하나의 문제에 의해 […]

SOC Prime로 DarkSide 랜섬웨어 탐지하기

Posted on 14.05.202109.08.2025 by Alla Yurchenko

상대적으로 새로운 사이버 위협 분야에서 다크사이드 랜섬웨어는 세계 유수의 판매자들에 대한 성공적인 공격으로 인해 뉴스 헤드라인을 계속 차지하고 있습니다. 최근 침입 목록에는 수백만 달러의 몸값을 지불한 화학 유통 회사 Brenntag와 미국 동부 연안에 연료 공급을 제공하는 Colonial Pipeline이 포함되어 있습니다. 다크사이드 랜섬웨어 개요 2020년 8월 러시아어로 된 지하 포럼에 등장한 이후, 다크사이드는 제3자 적대자를 이용해 […]

SystemBC 악성코드, 랜섬웨어 백도어로 점점 더 많이 사용됨

Posted on 14.05.202109.08.2025 by Alla Yurchenko

SystemBC의 새로운 버전이 점점 더 많이 랜섬웨어 유지 관리자에 의해 표적 환경에 진입하는 데 활용되고 있습니다. 보안 전문가들은 DarkSide, Ryuk, Cuba를 포함한 주요 랜섬웨어-서비스(RaaS) 집단이 SystemBC를 지속적인 백도어로 활용하여 공격된 인스턴스에 접근을 유지하고 다양한 악명높은 활동을 수행한다고 지적합니다. SystemBC란 무엇입니까? SystemBC는 프록시와 원격 접근 트로이 목마(RAT) 기능을 결합한 다기능 위협입니다. 처음 2019년에 발견된 이 악성코드는 […]

Microsoft Azure Sentinel 규칙을 SIEM 인스턴스에 생성하기

Posted on 13.05.202118.07.2025 by Sergiy Prystaiko

SOC Prime 위협 탐지 마켓플레이스 은 Microsoft Azure Sentinel 탐지 6,000개 이상에 대한 액세스를 제공하며, 여기에는 쿼리, 규칙, 기능 및 MITRE ATT&CK에 직접 매핑된 Incident Response Playbooks가 포함됩니다® 조직별 요구 사항에 맞춥니다. 적용하여 가장 관련성 높은 탐지를 매끄럽게 찾을 수 있습니다 Microsoft 정렬 옵션을 사용하여 몇 번의 클릭만으로 Azure Sentinel 인스턴스에 콘텐츠를 배포할 수 있습니다. […]

터널스네이크 작전: 모리야 루트킷 감지

Posted on 12.05.202109.08.2025 by Alla Yurchenko

카스퍼스키 연구원들은 수년간 중국과 연계된 APT 공격자가 감염된 인스턴스에 백도어를 설치하기 위해 은밀하게 활용한 이전에 알려지지 않은 Windows 루트킷을 발견했습니다. ‘모리야’로 명명된 이 루트킷은 공격자에게 네트워크 트래픽을 캡처하고 보안 제품의 탐지를 피하면서 손상된 장치에서 명령을 은밀하게 실행할 수 있는 능력을 제공합니다. 연구원들은 모리야가 아시아 및 아프리카 전역의 지역 외교 자산을 대상으로 한 사이버 스파이 활동인 […]

Dell BIOS 드라이버에서 권한 상승 취약점 (CVE-2021-21551) 탐지

Posted on 06.05.202109.08.2025 by Alla Yurchenko

전 세계의 Dell 컴퓨터는 2009년에 도입된 높은 심각도의 결함으로 인해 잠재적으로 공격에 취약할 수 있습니다. 전문가들에 따르면, CVE-2021-21551로 추적되는 다섯 가지 문제 세트가 Dell DBUtil 드라이버에 영향을 미치며, 공격자들이 영향을 받는 기기에서 커널 모드 권한을 획득할 수 있게 합니다. CVE-2021-21551은 이 드라이버에 10년 이상 존재했지만 현재로서는 야생에서 착취된 증거는 없습니다. CVE-2021-21551 설명 The 분석 SentinelLabs에 […]

Ivanti, 적극적으로 악용 중인 중요 Pulse Connect Secure 결함 패치

Posted on 05.05.202109.08.2025 by Alla Yurchenko

2021년 5월 3일, Ivanti는 Pulse Connect Secure SSL VPN 장치의 매우 심각한 보안 결함을 해결하는 보안 업데이트를 발표했습니다. 이러한 결함은 APT 행위자들이 미국의 정부 기관, 중요 인프라 객체, 사기업을 대상으로 사용했다고 보고되었습니다. Pulse Connect Secure 취약점 에 따르면 CISA 보안 경고 2021년 4월 20일, 여러 국가 지원 해커 그룹이 Pulse Connect Secure 버그를 활용하여 표적이 […]

Prometei 봇넷, 패치되지 않은 Microsoft Exchange 취약점을 이용하여 전파

Posted on 30.04.202109.08.2025 by Alla Yurchenko

보안 연구원들은 Prometei 봇네트의 악의적 전술에 중대한 변화가 있음을 밝혔습니다. 이제 Windows Exchange 서버에 대해 “ProxyLogon” 익스플로잇을 활용하여 타겟 네트워크에 침투하고 크립토재킹 악성코드를 사용자 기기에 배포할 수 있습니다. 주요 목표는 감염된 인스턴스의 처리 능력을 악용하여 모네로를 채굴하는 것이지만, Prometei의 광범위한 기능은 운영자가 APT 침입과 비교하여 복잡한 다양한 다른 고급 공격을 수행할 수 있게 합니다. Prometei […]

Passwordstate 공급망 공격으로 인해 29,000개 기업이 침해 위험에 노출

Posted on 28.04.202109.08.2025 by Alla Yurchenko

호주의 소프트웨어 생산업체 Click Studios가 보안 침해를 당하여 공급 체인 공격으로 이어졌습니다. 2020년 4월, 공격자들은 Click Studios의 Passwordstate 기업 비밀번호 관리 앱의 업그레이드 메커니즘을 성공적으로 훼손하여 사용자 기기에 Moserpass 악성코드를 전달했습니다. 현재 영향을 받은 고객 수는 알려지지 않았으나, 공급업체는 감염률이 매우 낮다고 주장하고 있습니다. 하지만 조사는 계속 진행 중이며, 최종 피해자 수가 늘어날 수 있습니다. […]

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.