Tag: Detection Content

Interview with Threat Bounty Developer: Nattatorn Chuensangarun
Interview with Threat Bounty Developer: Nattatorn Chuensangarun

Catch the latest newscast about SOC Prime’s community! Today we want to introduce Nattatorn Chuensangarun, a prolific detection content author contributing to our Threat Bounty Program since August 2021. Nattatorn is an active content developer, concentrating his efforts on Sigma rules. You can refer to Nattatorn’s detections of the highest quality and value in the […]

Read More
The Most Refined UEFI Firmware Implant: MoonBounce Detection
The Most Refined UEFI Firmware Implant: MoonBounce Detection

A newly minted UEFI firmware malicious implant dubbed “MoonBounce” is ravaging in the wild. The threat is believed to be the handiwork of a Chinese-speaking APT41 hacking gang, aka Double Dragon or Winnti. This UEFI rootkit is set out to cause a stir, having already obtained the title of the most stealthy of all the […]

Read More
Detect CVE-2022-21907: A Wormable RCE in Windows Server
Detect CVE-2022-21907: A Wormable RCE in Windows Server

Another day, another critical vulnerability posing a major headache for security practitioners. This time researchers have identified a wormable remote code execution (RCE) flaw that impacts the latest desktop and server Windows versions. The vendor urges everyone to upgrade their systems ASAP since the flaw could be easily leveraged by adversaries to execute arbitrary code […]

Read More
SOC Prime Threat Bounty — December 2021 Results
SOC Prime Threat Bounty — December 2021 Results

December ‘21 Results In December 2021, Threat Bounty Program developers contributed 219 new detections to the SOC Prime Platform. To ensure the continuous quality enhancement of the published content, 231 rules earlier released by Threat Bounty authors were improved and updated.  SOC Prime Threat Bounty results for the previous month are available in NOVEMBER ‘21 […]

Read More
Destructive Cyber-Attack Against Ukrainian Government
Destructive Cyber-Attack Against Ukrainian Government

Overview, Analysis, and Lessons Learned On January 13, 2021, a massive data-wiping cyber-attack hit Ukraine, taking down the online assets of the country’s government. As of January 17, 2021, up to 70 websites experienced temporary performance issues due to the intrusion, including the Cabinet, seven ministries, the Treasury, the National Emergency Service, and the state […]

Read More
Latest Zloader Campaign Abuses Microsoft Signature Verification
Latest Zloader Campaign Abuses Microsoft Signature Verification

Zloader (aka Terdot and DELoader) is raging worldwide, evading banking systems’ defenses. Not something one expects to find under their Christmas trees, especially accompanied by the calamitous Log4j Vulnerability, but these are some crazy times we live in. According to the researchers, Zloader attack routines are growing in scale and sophistication, adopting diversified techniques and […]

Read More
SysJoker Malware Detection
SysJoker Malware Detection

New Year, fresh start! And for threat actors as well. Meet a brand-new backdoor malware that has been increasingly hitting the cyber domain throughout the last couple of months. Dubbed SysJoker, the threat obtains powerful evasion capabilities while being able to target major operating systems, including Windows, Linux, and macOS. SysJoker Malware Analysis SysJocker malware […]

Read More
CVE-2021-45046, CVE-2021-44228 Detection: Vulnerabilities in Log4j Java Library
CVE-2021-45046, CVE-2021-44228 Detection: Vulnerabilities in Log4j Java Library

Yet another splitting headache for SOC teams — beware of the hottest Log4j vulnerability CVE-2021-45046! The cybersecurity world has just been shaken by an increasing amount of exploitation attempts for CVE-2021-44228, a critical zero-day vulnerability affecting the Apache Log4j Java logging library, while another high-severity Log4j RCE flaw tracked as CVE-2021-45046 comes on the scene.  […]

Read More
Detect CVE-2021-42287, CVE-2021-42278 Exploitation Сhain
Detect CVE-2021-42287, CVE-2021-42278 Exploitation Сhain

Adversaries have found a way to obtain full admin rights to the Active Directory (AD) domains by weaponizing CVE-2021-42287 and CVE-2021-42278 vulnerabilities. The nefarious exploitation chain enables Active Directory domain impersonation in just a couple of clicks. A batch of vulnerabilities tied to this exploitation chain drove the attention of security professionals in November 2021. […]

Read More
Detecting Grafana Zero-Day Vulnerability (CVE-2021-43798)
Detecting Grafana Zero-Day Vulnerability (CVE-2021-43798)

Brace yourself for the new zero-day vulnerability exploited in the wild. A recently-disclosed flaw affects Grafana, multi-platform open source analytics and interactive visualization app used by organizations globally to track and understand the metrics of their data. After the vulnerability details were occasionally leaked online, the multitude of proof-of-concept exploits spread over Twitter and GitHub, […]

Read More