Threat video1:00
Microsoft Data on Exploited CVEs: Analysis & Hunting
Only 0.5% of 383,000 CVEs were exploited in the wild, mostly takeover-class flaws. Includes 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Chapters
- 0:00The hookAbout 0.5% of CVEs are exploited.
- 0:04The storyThe exploited ones are takeovers.
- 0:11Attack pathServer-side and network edge devices.
- 0:25AttributionNo threat actor: this was defensive research.
- 0:29Indicators of compromiseNo malicious indicators were published.
- 0:35MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to credential access.
- 0:41Remediation3 steps now: Prioritize remediation of remote-takeover vulnerability classes on internet-exposed systems.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 0.5% of CVEs are exploited.
0:05The exploited ones are takeovers.
0:07Entry flaws lead to privilege.
0:11Server-side and network edge devices.
0:14Exploited within one day.
0:16Client-side code execution.
0:18Any entry route executes code.
0:25No threat actor: this was defensive research.
0:30No malicious indicators were published.
0:364 ATT&CK techniques, from initial access to credential access.
0:413 steps now: Prioritize remediation of remote-takeover vulnerability classes on internet-exposed systems.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.