Most interesting IR cases in 2023: insider threats and more
Tags
cmtmf-attack-pattern: Data Manipulation Develop Capabilities Exploit Public-Facing Application Masquerading
maec-delivery-vectors: Watering Hole
attack-pattern: Data Direct Abuse Elevation Control Mechanism - T1626 Abuse Elevation Control Mechanism - T1548 Additional Email Delegate Permissions - T1098.002 Bypass User Account Control - T1548.002 Clear Windows Event Logs - T1070.001 Create Or Modify System Process - T1543 Credentials - T1589.001 Data Manipulation - T1641 Data Manipulation - T1565 Develop Capabilities - T1587 Device Registration - T1098.005 Disable Or Modify System Firewall - T1562.004 Disable Windows Event Logging - T1562.002 Dll Side-Loading - T1574.002 Domain Accounts - T1078.002 Email Account - T1087.003 Email Forwarding Rule - T1114.003 Exploit Public-Facing Application - T1377 Exploitation For Client Execution - T1658 Exploits - T1587.004 Exploits - T1588.005 File Deletion - T1070.004 File Deletion - T1630.002 Hijack Execution Flow - T1625 Hijack Execution Flow - T1574 Impair Command History Logging - T1562.003 Impair Defenses - T1562 Impair Defenses - T1629 Ingress Tool Transfer - T1544 Local Accounts - T1078.003 Lsass Memory - T1003.001 Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Match Legitimate Name Or Location - T1036.005 Match Legitimate Name Or Location - T1655.001 Multi-Factor Authentication - T1556.006 Ntds - T1003.003 Password Guessing - T1110.001 Password Spraying - T1110.003 Phishing - T1660 Phishing - T1566 Protocol Tunneling - T1572 Remote Desktop Protocol - T1021.001 Security Account Manager - T1003.002 Server - T1583.004 Server - T1584.004 Server Software Component - T1505 Service Execution - T1569.002 Smb/Windows Admin Shares - T1021.002 Software - T1592.002 Spearphishing Link - T1566.002 Steal Web Session Cookie - T1539 System Services - T1569 Web Shell - T1505.003 Windows Service - T1543.003 Account Manipulation - T1098 Brute Force - T1110 Bypass User Account Control - T1088 Credential Dumping - T1003 File System Logical Offsets - T1006 Dll Side-Loading - T1073 Email Collection - T1114 Exploit Public-Facing Application - T1190 Exploitation For Client Execution - T1203 External Remote Services - T1133 File Deletion - T1107 Indicator Removal On Host - T1070 Remote File Copy - T1105 Masquerading - T1036 Modify Registry - T1112 Standard Non-Application Layer Protocol - T1095 Remote Desktop Protocol - T1076 Remote Services - T1021 Service Execution - T1035 Valid Accounts - T1078 Web Shell - T1100 User Execution - T1204 Exploit Public-Facing Application External Remote Services Masquerading Valid Accounts User Execution
Show in Graph
Common Information
Type Value
UUID 292e2da5-4614-4a08-ade4-dc2f6b53995c
Fingerprint b89d91d96d2ab001
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 3, 2024, 11 a.m.
Added to db Sept. 3, 2024, 1:44 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline A deep dive into the most interesting incident response cases of last year
Title Most interesting IR cases in 2023: insider threats and more
Detected Hints/Tags/Attributes 179/3/46
Source URLs
Redirection Url
Details Source https://securelist.com/incident-response-interesting-cases-2023/113611/
Details Source https://malware.news/t/a-deep-dive-into-the-most-interesting-incident-response-cases-of-last-year/85930
URL Provider
Details Provider Source level domain
Details malware.news malware.news
Details securelist.com securelist.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 158 ✔ Malware Analysis, News and Indicators - Latest topics https://malware.news/latest.rss 2024-08-30 22:08
Details 223 ✔ Securelist https://securelist.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 184 
cve-2021-26855
Details Domain 285 
microsoft.net
Details File 137 
conhost.exe
Details File 226 
certutil.exe
Details File 3 
wshelper.dll
Details File 28 
wlbsctrl.dll
Details File 3 
ikeext.dll
Details File 172 
dllhost.exe
Details IPv4 619 
0.0.0.0
Details MITRE ATT&CK Techniques 306 
T1078
Details MITRE ATT&CK Techniques 191 
T1133
Details MITRE ATT&CK Techniques 99 
T1539
Details MITRE ATT&CK Techniques 33 
T1565
Details MITRE ATT&CK Techniques 542 
T1190
Details MITRE ATT&CK Techniques 96 
T1587.001
Details MITRE ATT&CK Techniques 173 
T1003.001
Details MITRE ATT&CK Techniques 43 
T1003.002
Details MITRE ATT&CK Techniques 95 
T1572
Details MITRE ATT&CK Techniques 492 
T1105
Details MITRE ATT&CK Techniques 49 
T1110.003
Details MITRE ATT&CK Techniques 245 
T1203
Details MITRE ATT&CK Techniques 160 
T1021.001
Details MITRE ATT&CK Techniques 139 
T1021.002
Details MITRE ATT&CK Techniques 348 
T1036
Details MITRE ATT&CK Techniques 183 
T1566.002
Details MITRE ATT&CK Techniques 11 
T1098.005
Details MITRE ATT&CK Techniques 44 
T1110.001
Details MITRE ATT&CK Techniques 14 
T1098.002
Details MITRE ATT&CK Techniques 14 
T1114.003
Details MITRE ATT&CK Techniques 11 
T1587.004
Details MITRE ATT&CK Techniques 71 
T1078.002
Details MITRE ATT&CK Techniques 43 
T1078.003
Details MITRE ATT&CK Techniques 174 
T1569.002
Details MITRE ATT&CK Techniques 365 
T1204.002
Details MITRE ATT&CK Techniques 180 
T1543.003
Details MITRE ATT&CK Techniques 227 
T1574.002
Details MITRE ATT&CK Techniques 104 
T1505.003
Details MITRE ATT&CK Techniques 86 
T1548.002
Details MITRE ATT&CK Techniques 12 
T1006
Details MITRE ATT&CK Techniques 550 
T1112
Details MITRE ATT&CK Techniques 70 
T1562.004
Details MITRE ATT&CK Techniques 20 
T1562.002
Details MITRE ATT&CK Techniques 92 
T1070.001
Details MITRE ATT&CK Techniques 297 
T1070.004
Details MITRE ATT&CK Techniques 9 
T1562.003
Details MITRE ATT&CK Techniques 159 
T1095