CrowdStrike Discovers Use of of 64-bit Exploit by Hurricane Panda
Tags
attack-pattern: Credentials - T1589.001 Dll Side-Loading - T1574.002 Dns - T1071.004 Dns - T1590.002 Exploits - T1587.004 Exploits - T1588.005 Server - T1583.004 Server - T1584.004 Tool - T1588.002 Vulnerabilities - T1588.006 Dll Side-Loading - T1073 Remote Access Tools - T1219 Rootkit - T1014 Rootkit
Show in Graph
Common Information
Type Value
UUID b076e431-f2d8-4ed5-ae7e-36f1ed325784
Fingerprint b6b91815b0c7d6d5
Analysis status DONE
Considered CTI value 0
Text language
Published Oct. 14, 2014, 3:19 p.m.
Added to db Sept. 26, 2022, 9:33 a.m.
Last updated Dec. 19, 2024, 9:38 p.m.
Headline CrowdStrike Discovers Use of 64-bit Zero-Day Privilege Escalation Exploit (CVE-2014-4113) by Hurricane Panda
Title CrowdStrike Discovers Use of of 64-bit Exploit by Hurricane Panda
Detected Hints/Tags/Attributes 48/1/5
Source URLs
Redirection Url
Details Source https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
URL Provider
Details Provider Source level domain
Details crowdstrike.com www.crowdstrike.com
Attributes
Details Type #Events CTI Value
Details CVE 28 
cve-2014-4113
Details Domain 78 
crowdstrike.com
Details Email 14 
sales@crowdstrike.com
Details File 4 
win64.exe
Details Yara rule 1 
rule CrowdStrike_CVE_2014_4113 {
	meta:
		copyright = "CrowdStrike, Inc"
		description = "CVE-2014-4113 Microsoft Windows x64 Local Privilege Escalation Exploit"
		version = "1.0"
		last_modified = "2014-10-14"
		in_the_wild = true
	strings:
		$const1 = { FB FF FF FF }
		$const2 = { 0B 00 00 00 01 00 00 00 }
		$const3 = { 25 00 00 00 01 00 00 00 }
		$const4 = { 8B 00 00 00 01 00 00 00 }
	condition:
		all of them
}