Critical Remote Code Execution Vulnerabilities in Windows RPC Runtime https://www.akamai.com/blog/security/critical-remote-code-execution-vulnerabilities-windows-rpc-runtime
Akamai
Remote Code Execution Vulnerabilities in RPC | Akamai Blog | Akamai
Microsoft’s April 2022 Patch Tuesday introduced patches to more than a hundred new vulnerabilities in various components. Three critical vulnerabilities were found and patched in Windows RPC (Remote Procedure Call) runtime:
CVE-2022-24492 and CVE-2022-24528…
CVE-2022-24492 and CVE-2022-24528…
CVE-2022-25165:
Privilege Escalation to SYSTEM in AWS VPN Client https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
Privilege Escalation to SYSTEM in AWS VPN Client https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
Rhino Security Labs
CVE-2022-25165: Privilege Escalation to SYSTEM in AWS VPN Client
The AWS VPN Client application is affected by an arbitrary file write as SYSTEM, which can lead to privilege escalation.
Tarrask malware uses scheduled tasks for defense evasion https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
Microsoft News
Tarrask malware uses scheduled tasks for defense evasion
Microsoft Detection and Response Team (DART) researchers have uncovered malware that creates “hidden” scheduled tasks as a defense evasion technique. In this post, we will demonstrate how threat actors create scheduled tasks, how they cover their tracks,…
CVE-2022-0354: Local Privilege Escalation
Lenovo Commercial Vantage Tool https://www.infosec.tirol/cve-2022-0354/
Lenovo Commercial Vantage Tool https://www.infosec.tirol/cve-2022-0354/
Writing a Mutation Engine and breaking Aimware https://back.engineering/13/04/2022/
Obfuscated obfuscation https://blog.lexfo.fr/dexguard.html
Windows Ports, Protocols, and System Services https://social.technet.microsoft.com/wiki/contents/articles/1772.windows-ports-protocols-and-system-services.aspx
The big idea: should we get rid of the scientific paper? https://www.theguardian.com/books/2022/apr/11/the-big-idea-should-we-get-rid-of-the-scientific-paper
the Guardian
The big idea: should we get rid of the scientific paper?
As a format it’s slow, encourages hype, and is difficult to correct. A radical overhaul of publishing could make science better
Industroyer2: Industroyer reloaded https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
WeLiveSecurity
Industroyer2: Industroyer reloaded
ESET researchers have responded to a cyber-incident that affected an energy provider in Ukraine and involved ICS-capable malware that we've named Industroyer2.
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/
Microsoft News
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
Microsoft took action against the ZLoader trojan by working with telecommunications providers around the world to disrupt key ZLoader infrastructure. In this blog, we detail the various characteristics for identifying ZLoader activity, including its associated…
Critical Remote Code Execution Vulnerabilities in Windows RPC Runtime
https://www.akamai.com/blog/security/critical-remote-code-execution-vulnerabilities-windows-rpc-runtime
https://www.akamai.com/blog/security/critical-remote-code-execution-vulnerabilities-windows-rpc-runtime
Akamai
Remote Code Execution Vulnerabilities in RPC | Akamai Blog | Akamai
Microsoft’s April 2022 Patch Tuesday introduced patches to more than a hundred new vulnerabilities in various components. Three critical vulnerabilities were found and patched in Windows RPC (Remote Procedure Call) runtime:
CVE-2022-24492 and CVE-2022-24528…
CVE-2022-24492 and CVE-2022-24528…
Blinding Snort: Breaking the Modbus OT Preprocessor https://claroty.com/2022/04/14/blog-research-blinding-snort-breaking-the-modbus-ot-preprocessor/
Claroty
Blinding Snort IDS/IPS: Breaking the Modbus OT Preprocessor
Team82 discovered a means by which it could blind the popular Snort intrusion detection and prevention system to malicious packets. Learn more with Claroty.
365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments https://www.kitploit.com/2022/04/365inspect-powershell-script-that.html
KitPloit - PenTest & Hacking Tools
365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments
Turncoat: Tool For Enumerating Telegram Bot Secret Messages https://github.com/DODC/turncoat
GitHub
GitHub - DODC/turncoat
Contribute to DODC/turncoat development by creating an account on GitHub.
Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/
The GitHub Blog
Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read…
Use-After-Free Exploit in HackSysExtremeVulnerableDriver https://sophieboyle.github.io/2022/04/09/HEVD-UAF-Exploit.html
The Anti-VM trick that is kinda… personal https://www.hexacorn.com/blog/2022/04/16/the-anti-vm-trick-that-is-kinda-personal/
Diving Deeper into WatchGuard Pre-Auth RCE - CVE-2022-26318 https://blog.assetnote.io/2022/04/13/watchguard-firebox-rce/