The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.
Azure Synapse Analytics is an analytics service for processing data using various runtimes, among them Apache Spark. Synapse provided users the capability to mount Azure File Shares to their Apache Spark Pools via a script called filesharemount.sh that would execute with elevated privileges. This script would mount the File Share to the /synfs directory. There was a race condition in the script where, if successfully exploited, a user could execute the chown command to change the ownership of a…
The Microsoft Azure Site Recovery suite contained a DLL hijacking flaw that allowed for privilege escalation from any low privileged user to SYSTEM on hosts where this service was installed. Incorrect permissions on the cxprocessserver service's executable directory allowed new files to be created in it by any user. Since the service ran automatically and with SYSTEM privileges and attempted to load DLLs from the directory, this allowed for a DLL hijacking / planting attack.
A vulnerability in Service Fabric allows Linux containers to escalate their privileges in order to gain root privileges on the node, and then compromise all of the nodes in the cluster. An attacker would need to have read/write access to the cluster, and the vulnerability could be exploited on containers that are configured to have runtime access, but this is granted by default to every container. Though the bug exists in both the Windows and Linux versions, it is only exploitable on Linux.
A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.
Our partners at United Systems and F1 Solutions talk about their respective journeys with our Managed Microsoft Defender solution.
Upon blocking a request, GCP Org policy constraints were logging the deny logs in Principal''s project and the blocking project. An attacker could use those logs to exfiltrate any data, by making request from a Principal they own from a defender project.
Huntress is monitoring a new threat against Windows OS and Microsoft Office products (CVE-2021-40444). The MSHTML engine is vulnerable to arbitrary code execution.
We clarify the differences between the ProxyShell (August 2021) and the ProxyLogon (March 2021) exploits impacting Microsoft Exchange on-premises servers.
Attackers are scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Exchange vulnerabilities that were patched in early 2021.
Huntress is aware of PrintNightmare, a critical RCE and local privilege escalation vulnerability. This serious security flaw affects many Windows servers.
Azure forces the install of an agent on Linux VMs, which contained a vulnerability that would grant root RCE if an attacker could send a web request to them. Initially, Microsoft did not update the agent automatically, and so customers had to patch manually, but a few days later they began patching some services remotely.
Windows' administrative shares feature is often overlooked by users, but not by hackers. Learn how attackers abuse administrative shares to propagate.
On-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.
Microsoft Defender Antivirus is among one of the leading antivirus contenders. Here’s why it’s worth taking another look at Defender AV.
Hackers getting better at their tradecraft and their skills are becoming more and more accessible to other bad actors via the Dark Web.
GuardDuty detected CloudTrail being outright disabled, but did not detect if an attacker with the necessary permissions filtered out all events from CloudTrail via PutEventSelectors, resulting in defenders having no logs to review. AWS fixed this issue by adding a GuardDuty detection that triggers if PutEventSelectors is used to disable all event types.
Explore the forensic perspective of the Microsoft Edge Chromium-based version and its features, such as msedge_proxy, edge cache location, and more.
Read more about Huntress validating the SolarWinds N-central “Dumpster Diver” Vulnerability.
Forensic artifacts, which can be found during forensic examination of a Windows endpoint.
Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders find evidence of execution.
Does AUTOEXEC.BAT still run on modern Windows? We test Windows 7/10, explore registry persistence, and revisit how attackers maintain access today.
IT Nation 2016 ended on a high note for Huntress Labs as we were named the “Best Newcomer” in the Partner Choice Awards. Now, as this year’s event quickly approaches, we are excited to continue our momentum.
Dive deep into Redosdru malware analysis, unpacking encrypted DLLs, keylogging behavior, and how Huntress defenders detect and respond.
When it comes to troubleshooting software errors, analyzing malware samples, or discovering security misconfigurations, the Sysinternals Suite can likely solve your problem. For many IT and Security professionals, this collection of Windows utilities is similar to the Swiss Army knife.
