Bartosz Cieszewski

🚨 July 21 Update on Microsoft SharePoint 0-day (CVE-2025-53770 and CVE-2025-53771) Threat Campaigns 🚨 Here are some initial observations from the past 48 hours: ☣️ Microsoft just released security updates for all supported versions of Microsoft SharePoint. Patch now. ☣️ The early 0-day exploitation was broad and opportunistic. We're aware of victims in several sectors and global geographies. The activity primarily involved the theft of machine key material which could be used to access victim environments after the patch has been applied. ☣️ We assess that at least one of the actors responsible for the early exploitation is a China-nexus threat actor.  ☣️ Multiple threat actors are actively exploiting this vulnerability now. New threat actors with diverse motivations will continue to exploit these vulnerabilities over time. ☣️ Several security researchers are actively scanning for vulnerable SharePoint servers and looking for evidence of compromise. Some security vendors are exploiting the vulnerability to determine if the SharePoint server is still vulnerable.  ☣️ There is a lot of noise in logs. Organizations will likely see multiple discrete sets of activity. Some may be associated with threat actors, some may be security researchers/scanners. Every organization with on-premises Microsoft SharePoint should do the following: 1️⃣ Apply the patches right away. 2️⃣ Rotate SharePoint Server ASP.NET machine keys. 3️⃣ Enable additional security controls such as Windows Antimalware Scan Interface (AMSI) and EDR. 4️⃣ Forensically examine your SharePoint system to determine if it was already compromised❗

259

10 komentarzy

LogonTracer: Visualizes Suspicious Activities - Free! Who logged into the network and how? A single logon event can provide critical insights into the timeline of an attack, but without the right tools, connecting the dots is a challenge. LogonTracer makes this process easier by analyzing Windows Active Directory event logs and visualizing them as graphs. This allows security teams to identify patterns quickly. Whether it's a series of failed logins or unusual authentication requests: • Visualize logon data with Neo4j & Cytoscape • Install with Docker for easy setup • Detailed event log analysis in chronological order • Use advanced algorithms to pinpoint suspicious activity Learn more: https://lnkd.in/gd535s84 Threat hunting isn’t just about identifying a potential attack; it’s about understanding the context around it. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

358

12 komentarzy

I usually show firmware extraction the hard way: via chip-off rework. But, what if there was an easier way to get a device's firmware for analysis? Well surely if we have a shell on the device that should help! In my latest blog post and video, I show the process of firmware extraction using a root shell obtained previously, and the device's SDCard slot, to exfiltrate the firmware. https://lnkd.in/esA9aNNT https://lnkd.in/eTUJR_kY #IoTSecurityWeek

176

5 komentarzy

🚨KQL Alarm🚨 Some of the KQL Nerds maybe have seen the Blog from Rod Trent (https://lnkd.in/dieRmPRt) about external data integration in KQL. here is a Quick Query wich uses the Threatview.io High Confidence Domain List to detect if there are any DeviceNetworkevents to Domains listed on the Feed. Links to Query: https://lnkd.in/dir65b5t https://lnkd.in/dpwUXd9m #KQL #Microsoft #Defender #ThreatHunting #Cybersecurity #ThreatDetection #DFIR #SOC #detectionsai

108

2 komentarze

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77