페이지 81 | SOC Prime

NOBELIUM APT, 전 세계 정부 대상 대규모 스피어 피싱 캠페인 실행

Posted on 02.06.202109.08.2025 by Alla Yurchenko

Microsoft 전문가들은 러시아와 연계된 NOBELIUM APT에 의해 주요 정부 기관, 싱크탱크 및 국제 NGO를 대상으로 수행된 스피어 피싱 캠페인에서 중요한 변화가 있었음을 밝혀냈습니다. 연구자들에 따르면, 해커 집단은 24개국의 150개 이상의 조직을 공격하여 피해자에게 악성코드를 감염시키고 내부 네트워크에 은밀하게 접근하는 것을 목표로 했습니다. 특히, 같은 행위자가 역사적인 SolarWinds 공급망 공격 을 배후에 두고 있는 것으로 의심됩니다. […]

Windows HTTP.sys의 Wormable RCE 취약점 (CVE-2021-31166) 탐지

Posted on 24.05.202109.08.2025 by Alla Yurchenko

Microsoft는 최근 Windows 10 및 Windows Server를 실행하는 기계에서 커널 권한을 가진 원격 코드 실행을 가능하게 하는 매우 심각한 버그(CVE-2021-31166)를 수정했습니다. 공급업체는 이 결함이 웜 가능성이 있으며 조직 네트워크 내 여러 서버 전반에 걸쳐 스스로 전파되어 최대 피해를 줄 수 있다고 경고합니다. 이미 개념 증명(PoC) 익스플로잇이 공개되어 범죄자들이 야생에서 공격을 위해 취약점을 무기화하도록 자극하고 있습니다. […]

위협 바운티 개발자인 미셸 드 크르부아지에 인터뷰

Posted on 19.05.202125.06.2025 by Alla Yurchenko

SOC Prime Developers 커뮤니티에 대한 최신 뉴스 캐스트를 만나보세요! 오늘 우리는 2020년 11월부터 우리의 Threat Bounty Program에 기여하고 있는 다작 개발자 Michel de Crevoisier를 소개하고자 합니다. Michel은 Sigma 규칙에 집중하는 활발한 콘텐츠 제작자로, Threat Detection Marketplace에서 최고 품질과 가치를 자랑하는 Michel의 탐지를 참조할 수 있습니다. 탐지 콘텐츠 보기 1. 본인 및 사이버 보안 분야의 경험에 […]

Rapid7, Codecov 공급망 공격의 희생양이 되다

Posted on 18.05.202109.08.2025 by Alla Yurchenko

주요 사이버 보안 회사 Rapid7은 Codecov 공급망 공격의 과정에서 소스 코드 리포지토리의 일부가 노출되었다고 발표했습니다. 공식 성명에 따르면, 손상된 리포는 내부 인증 정보와 MDR(Managed Detection and Response) 고객을 위한 경고 관련 데이터를 포함하고 있었습니다. Codecov 공급망 공격 2021년 4월 15일, 소프트웨어 감사 회사 Codecov은 발표했습니다. 그의 Bash Uploader 스크립트가 미확인 행위자에 의해 백도어가 설치되었다고 합니다. […]

FragAttacks 감지: 새로 발견된 WiFi 결함 개요

Posted on 17.05.202109.08.2025 by Alla Yurchenko

보안 전문가들은 Wi-Fi 표준의 최근 발견된 취약점 세트로 인해 또 한 번 경계를 늦추지 않고, 커피를 많이 준비해야 할 것입니다. 이 결함들은 FragAttacks로 통칭되며, 거의 모든 무선 장치에 영향을 미치고, 적들이 취약한 시스템을 통제하여 비밀 정보를 가로채게 할 수 있습니다. 이러한 경이로운 버그를 공개한 보안 전문가 Mathy Vanhoef는 모든 Wi-Fi 제품이 최소한 하나의 문제에 의해 […]

SOC Prime로 DarkSide 랜섬웨어 탐지하기

Posted on 14.05.202109.08.2025 by Alla Yurchenko

상대적으로 새로운 사이버 위협 분야에서 다크사이드 랜섬웨어는 세계 유수의 판매자들에 대한 성공적인 공격으로 인해 뉴스 헤드라인을 계속 차지하고 있습니다. 최근 침입 목록에는 수백만 달러의 몸값을 지불한 화학 유통 회사 Brenntag와 미국 동부 연안에 연료 공급을 제공하는 Colonial Pipeline이 포함되어 있습니다. 다크사이드 랜섬웨어 개요 2020년 8월 러시아어로 된 지하 포럼에 등장한 이후, 다크사이드는 제3자 적대자를 이용해 […]

SystemBC 악성코드, 랜섬웨어 백도어로 점점 더 많이 사용됨

Posted on 14.05.202109.08.2025 by Alla Yurchenko

SystemBC의 새로운 버전이 점점 더 많이 랜섬웨어 유지 관리자에 의해 표적 환경에 진입하는 데 활용되고 있습니다. 보안 전문가들은 DarkSide, Ryuk, Cuba를 포함한 주요 랜섬웨어-서비스(RaaS) 집단이 SystemBC를 지속적인 백도어로 활용하여 공격된 인스턴스에 접근을 유지하고 다양한 악명높은 활동을 수행한다고 지적합니다. SystemBC란 무엇입니까? SystemBC는 프록시와 원격 접근 트로이 목마(RAT) 기능을 결합한 다기능 위협입니다. 처음 2019년에 발견된 이 악성코드는 […]

Microsoft Azure Sentinel 규칙을 SIEM 인스턴스에 생성하기

Posted on 13.05.202118.07.2025 by Sergiy Prystaiko

SOC Prime 위협 탐지 마켓플레이스 은 Microsoft Azure Sentinel 탐지 6,000개 이상에 대한 액세스를 제공하며, 여기에는 쿼리, 규칙, 기능 및 MITRE ATT&CK에 직접 매핑된 Incident Response Playbooks가 포함됩니다® 조직별 요구 사항에 맞춥니다. 적용하여 가장 관련성 높은 탐지를 매끄럽게 찾을 수 있습니다 Microsoft 정렬 옵션을 사용하여 몇 번의 클릭만으로 Azure Sentinel 인스턴스에 콘텐츠를 배포할 수 있습니다. […]

터널스네이크 작전: 모리야 루트킷 감지

Posted on 12.05.202109.08.2025 by Alla Yurchenko

카스퍼스키 연구원들은 수년간 중국과 연계된 APT 공격자가 감염된 인스턴스에 백도어를 설치하기 위해 은밀하게 활용한 이전에 알려지지 않은 Windows 루트킷을 발견했습니다. ‘모리야’로 명명된 이 루트킷은 공격자에게 네트워크 트래픽을 캡처하고 보안 제품의 탐지를 피하면서 손상된 장치에서 명령을 은밀하게 실행할 수 있는 능력을 제공합니다. 연구원들은 모리야가 아시아 및 아프리카 전역의 지역 외교 자산을 대상으로 한 사이버 스파이 활동인 […]

Dell BIOS 드라이버에서 권한 상승 취약점 (CVE-2021-21551) 탐지

Posted on 06.05.202109.08.2025 by Alla Yurchenko

전 세계의 Dell 컴퓨터는 2009년에 도입된 높은 심각도의 결함으로 인해 잠재적으로 공격에 취약할 수 있습니다. 전문가들에 따르면, CVE-2021-21551로 추적되는 다섯 가지 문제 세트가 Dell DBUtil 드라이버에 영향을 미치며, 공격자들이 영향을 받는 기기에서 커널 모드 권한을 획득할 수 있게 합니다. CVE-2021-21551은 이 드라이버에 10년 이상 존재했지만 현재로서는 야생에서 착취된 증거는 없습니다. CVE-2021-21551 설명 The 분석 SentinelLabs에 […]

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.