Threat video1:00
GreyNoise Pre-Disclosure Scan Surges: Analysis & Hunting
GreyNoise found 68 scanning surges preceded vendor CVEs by 11 days on median. Hunt with 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for GreyNoise Pre-Disclosure Scan Surges: Analysis & Hunting →
Chapters
- 0:00The hookAttackers surge scanning eleven days before disclosure.
- 0:04The storyReports show scans surge eleven days before disclosure.
- 0:10Attack pathReportedly, exploit authentication bypass to gain network access.
- 0:30AttributionNo threat actor is attributed.
- 0:34Indicators of compromise10 indicators to hunt: 10 IPs.
- 0:39MITRE ATT&CK techniques7 ATT&CK techniques, from reconnaissance to collection.
- 0:44Remediation4 steps now: Patch Cisco Catalyst SD-WAN Controller/Manager.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Attackers surge scanning eleven days before disclosure.
0:05Reports show scans surge eleven days before disclosure.
0:08GreyNoise tracked the pattern.
0:11Reportedly, exploit authentication bypass to gain network access.
0:16Exfiltrate configurations, create new admin accounts.
0:19Deploy persistent command-and-control backdoors into infrastructure.
0:24This pattern preceded vendor CVE disclosures by eleven days.
0:30No threat actor is attributed. Confidence: low.
0:3410 indicators to hunt: 10 IPs.
0:407 ATT&CK techniques, from reconnaissance to collection.
0:444 steps now: Patch Cisco Catalyst SD-WAN Controller/Manager.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.