Threat video1:00
N-able N-central Able2Shell XXE-to-RCE: Detection & IOCs
Oracle-Security's GitHub PoC dump claims 33 N-central flaws; hunt them with 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for N-able N-central Able2Shell XXE-to-RCE: Detection & IOCs →
Chapters
- 0:00The hook33 alleged flaws published with proof-of-concept code.
- 0:04The storyOn Nov 8, a GitHub account published it.
- 0:11Attack pathAlleged: unauthenticated flaws chain to code execution.
- 0:28AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromise6 indicators to hunt: 3 IPs, 1 domain and 1 file name, and more.
- 0:39MITRE ATT&CK techniques10 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation4 steps now: Upgrade on-premises N-central.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0033 alleged flaws published with proof-of-concept code.
0:05On Nov 8, a GitHub account published it.
0:08N-able took hosted N-central offline.
0:11Alleged: unauthenticated flaws chain to code execution.
0:15Then alleged credential disclosure and administrator-account creation.
0:20Legitimate functions can reach every managed endpoint.
0:23None of this is independently verified yet.
0:29No threat actor: this was defensive research.
0:336 indicators to hunt: 3 IPs, 1 domain and 1 file name, and more.
0:3910 ATT&CK techniques, from reconnaissance to impact.
0:444 steps now: Upgrade on-premises N-central.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.