Threat video1:00
Hyper-V Exploit Research (ER 05): Analysis & Hunting
Borges works through Hyper-V vulnerability research in a 57-page PDF, mapped to 4 ATT&CK techniques with 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Hyper-V Exploit Research (ER 05): Analysis & Hunting →
Chapters
- 0:00The hookA 57-page guide to reverse-engineering Hyper-V.
- 0:05The storyAlexandre Borges launched the fifth installment.
- 0:12Attack pathThe research covered vulnerability discovery in hypervisors.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromise4 indicators to hunt: 1 domain, 2 URLs and 1 file name.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from resource development to stealth.
- 0:43Remediation1 step now: No vulnerability or exploitation is stated in the source.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A 57-page guide to reverse-engineering Hyper-V.
0:05Alexandre Borges launched the fifth installment.
0:08It explored Hyper-V exploitation and escape.
0:12The research covered vulnerability discovery in hypervisors.
0:16Then execution techniques and code flows examined.
0:19Escape mechanisms for privilege escalation thoroughly analyzed.
0:24Finally stealth and evasion techniques explored.
0:29No threat actor: this was defensive research.
0:334 indicators to hunt: 1 domain, 2 URLs and 1 file name.
0:394 ATT&CK techniques, from resource development to stealth.
0:441 step now: No vulnerability or exploitation is stated in the source.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.