TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Vulnerabilities, Exploits, and Malware Driving Attack Campaigns in October 2019

2019-11-26 · Read original ↗

ATT&CK techniques detected

13 predictions
T1190Exploit Public-Facing Application
98%
“analysis, we ’ re presenting new analysis here on a different attack campaign targeting the same vulnerability. in october, threat actors were very focused on executing commands remotely. initial request to exploit this vulnerability, a threat actor needs to send a post request t…”
T1190Exploit Public-Facing Application
98%
“##lletin ' ) ; echo ' - > | ' ; file _ put _ contents ( $ _ server [ ' document _ root ' ]. ' / webconfig. txt. php ', base64 _ decode ( ' pd9wahagzxzhbcgkx1bpu1rbmv0poz8 + ' ) ) ; echo ' | < - ' ; exit ; the threat actor creates a file named webconfig. txt. php within the webser…”
T1059.001PowerShell
96%
“affecting these servers. we have covered these vulnerabilities in previous editions of this monthly series. a new campaign targeting this vulnerability was detected in october ; the goal was to execute commands remotely. this differs from previous campaigns attempting to exploit …”
T1059.001PowerShell
92%
“environment variables used in dos, os / 2, and windows. it normally points to the command line interpreter, which is by default command. com in dos or cmd. exe in os / 2 and windows nt. the script then invokes powershell. exe and provides the following arguments : - nop ( - nopro…”
T1190Exploit Public-Facing Application
92%
“, an anonymous researcher posted a proof - of - concept ( poc ) zero - day exploit on seclists. org. the exploit targeted servers that run vbulletin ( v5. 0. 0 - v5. 5. 4 ) cms. the anonymous researcher did not indicate whether he or she tried to contact vbulletin maintainers to …”
T1190Exploit Public-Facing Application
88%
“vulnerabilities, exploits, and malware driving attack campaigns in october 2019 security researchers at f5 networks constantly monitor web traffic at various locations all over the world. this allows us to detect “ in the wild ” malware, and to get an insight into the current thr…”
T1190Exploit Public-Facing Application
84%
“to elasticsearch groovy scripting engine sandbox security bypass vulnerability ( cve - 2015 - 1427 ). the threat actor instructs the server to download and execute a malicious file. - thinkphp remote code execution ( cve - 2018 - 10225 ). the threat actor instructs the server to …”
T1055.001Dynamic-link Library Injection
80%
“64 - bit by checking the size of intptr. the script then invokes another powershell script that contains a compressed base64 - encoded string using a gzip compression algorithm. figure 5. the decompressed base64 - encoded powershell code uses dotnet apis to invoke the windows api…”
T1027.010Command Obfuscation
76%
“environment variables used in dos, os / 2, and windows. it normally points to the command line interpreter, which is by default command. com in dos or cmd. exe in os / 2 and windows nt. the script then invokes powershell. exe and provides the following arguments : - nop ( - nopro…”
T1190Exploit Public-Facing Application
63%
“affecting these servers. we have covered these vulnerabilities in previous editions of this monthly series. a new campaign targeting this vulnerability was detected in october ; the goal was to execute commands remotely. this differs from previous campaigns attempting to exploit …”
T1059.001PowerShell
51%
“64 - bit by checking the size of intptr. the script then invokes another powershell script that contains a compressed base64 - encoded string using a gzip compression algorithm. figure 5. the decompressed base64 - encoded powershell code uses dotnet apis to invoke the windows api…”
T1055Process Injection
42%
“64 - bit by checking the size of intptr. the script then invokes another powershell script that contains a compressed base64 - encoded string using a gzip compression algorithm. figure 5. the decompressed base64 - encoded powershell code uses dotnet apis to invoke the windows api…”
T1190Exploit Public-Facing Application
41%
“) serves as the first line of defense for their applications. one that ’ s well - monitored, configured, and updated should also be able to stop these threat actors from exploiting vulnerable systems within a network. f5 security researchers continuously monitor new web applicati…”

Summary

Vulnerable web servers are the top target for threat actors, who continue to exploit known vulnerabilities with the goal of running commands remotely.