TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Sensor Intel Series: Top CVEs in July 2022

2022-08-22 · Read original ↗

ATT&CK techniques detected

7 predictions
T1190Exploit Public-Facing Application
92%
“). nvd cve - 2017 - 18368 a critical command injection vulnerability in zyxel router model no. p660hn - t1a v1 tclinux fw $ 7. 3. 15. 0 v001 / 3. 40 ( ulm. 0 ) b31. traffic targeting this vulnerability in our logs was completely uniform, requesting exactly the same uri every time…”
T1190Exploit Public-Facing Application
89%
“more complicated mitigation requirements, they bear mention because of the sheer volume and focus that they receive from attackers. if you ’ re running a wordpress or pma site, your security posture deserves an extra look - over ( or two ). cve writeups below you will find brief …”
T1046Network Service Discovery
82%
“this was observed. nvd july port scan data f5 labs also analyzes data for tcp ports other than 80 and 443 from the effluxio network. the top 10 ports for july 2022 follow patterns we ’ ve been seeing for years, with port 5900 ( vnc ) topping the list, followed by a collection of …”
T1059.004Unix Shell
81%
“1. x before 13. 1. 3. 6, and 12. 1. x before 12. 1. 5. 3 and big - iq 7. 1. 0. x before 7. 1. 0. 3 and 7. 0. 0. x before 7. 0. 0. 2. in our dataset, a handful of these simply checked if a command could be run, but in most cases, an attempt was made to download a shell script from…”
T1498Network Denial of Service
55%
“july were iot vulnerabilities. 2021 and 2022 have seen several record - breaking ddos attacks, and we know how useful iot devices are for ddos attacks ( / content / f5 - labs - v2 / en / labs / articles / threat - intelligence / the - hunt - for - iot - - so - easy - to - comprom…”
T1190Exploit Public-Facing Application
54%
“1. x before 13. 1. 3. 6, and 12. 1. x before 12. 1. 5. 3 and big - iq 7. 1. 0. x before 7. 1. 0. 3 and 7. 0. 0. x before 7. 0. 0. 2. in our dataset, a handful of these simply checked if a command could be run, but in most cases, an attempt was made to download a shell script from…”
T1498.001Direct Network Flood
32%
“july were iot vulnerabilities. 2021 and 2022 have seen several record - breaking ddos attacks, and we know how useful iot devices are for ddos attacks ( / content / f5 - labs - v2 / en / labs / articles / threat - intelligence / the - hunt - for - iot - - so - easy - to - comprom…”

Summary

Learn which CVEs attackers scanned for the most in July 2022, and how it compares with the rest of the year.