Threat video1:00
Microsoft 383K-CVE Exploit Study: Analysis & Hunting
Microsoft found 2,056 exploited CVEs among 383,000, and 78% are takeover bugs; 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft 383K-CVE Exploit Study: Analysis & Hunting →
Chapters
- 0:00The hook78% of real-world exploits are takeover-class.
- 0:05The story383,000 CVEs analyzed.
- 0:12Attack pathAttackers exploit zero-days within one day, targeting network edge devices and server-side services.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques3 ATT&CK techniques, from initial access to credential access.
- 0:43Remediation3 steps now: Prioritize patching takeover-class vulnerabilities on exposed assets.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0078% of real-world exploits are takeover-class.
0:05383,000 CVEs analyzed. 0.5% exploited in the wild.
0:13Attackers exploit zero-days within one day, targeting network edge devices and server-side services.
0:20Remote code execution, authentication bypass, escalation, and disclosure: the attackers' takeover playbook.
0:29No threat actor is attributed. Confidence: low.
0:34No malicious indicators were published.
0:393 ATT&CK techniques, from initial access to credential access.
0:443 steps now: Prioritize patching takeover-class vulnerabilities on exposed assets.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.