NetSupport 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (204)

言語

en	180
zh	12
fr	4
ar	2
de	2

国・地域

us	92
cn	54
ce	6
tr	4
gb	2

アクター

Cobalt Strike	12
NetSupportManager RAT	11
Raccoon	9
SideWinder	8
RecordBreaker	8

関心

タイプ

Not Defined	80
Firewall Software	12
Router Operating System	12
WordPress Plugin	12
Content Management System	6

ベンダー

Not Defined	60
Microsoft	12
Cisco	6
Hikvision	6
Siemens	6

製品

WordPress	4
Microsoft Exchange Server	4
F5 BIG-IP	4
Siemens SPPA-T3000 Application Server	4
Sophos Cyberoam Firewall	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.17	CVE-2010-0966
2	Atmail Remote Code Execution	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00251	0.04	CVE-2013-5033
3	Palo Alto PAN-OS GlobalProtect Clientless VPN メモリ破損	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00112	0.03	CVE-2021-3056
4	WordPress SQLインジェクション	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.07	CVE-2022-21664
5	VeronaLabs wp-statistics Plugin API Endpoint Blind SQLインジェクション	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00250	0.00	CVE-2019-13275
6	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩	5.3	5.2	$5k-$25k	計算中	High	Workaround	0.02016	0.00	CVE-2007-1192
7	Linksys WRT54GL Web Management Interface SysInfo1.htm 情報の漏洩	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00046	0.07	CVE-2024-1406
8	Teclib GLPI unlock_tasks.php SQLインジェクション	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.12149	0.03	CVE-2019-10232
9	Sophos Firewall User Portal/Webadmin 弱い認証	8.5	8.5	$0-$5k	$0-$5k	High	Not Defined	0.97418	0.00	CVE-2022-1040
10	CutePHP CuteNews 特権昇格	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02107	0.04	CVE-2019-11447
11	WordPress Object 特権昇格	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00432	0.00	CVE-2022-21663
12	Microsoft Windows Active Directory Domain Services Privilege Escalation	8.8	8.3	$25k-$100k	$0-$5k	High	Official Fix	0.07084	0.03	CVE-2022-26923
13	QNAP QTS Media Library 特権昇格	8.5	8.2	$0-$5k	$0-$5k	High	Official Fix	0.01575	0.03	CVE-2017-13067
14	OpenSSH Authentication Username 情報の漏洩	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.10737	0.59	CVE-2016-6210
15	Samurai Build File util.c canonpath メモリ破損	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00085	0.00	CVE-2019-19795
16	Phpsugar PHP Melody page_manager.php クロスサイトスクリプティング	5.2	4.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00087	0.00	CVE-2017-15648
17	MikroTik RouterOS FTP Request メモリ破損	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00107	0.06	CVE-2020-22845
18	Simple and Beautiful Shopping Cart System uploadera.php 特権昇格	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00170	0.00	CVE-2023-1558
19	RealNetworks RealServer Port 7070 Service サービス拒否	7.5	7.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.02116	0.15	CVE-2000-0272
20	Microsoft Windows Themes 情報の漏洩	5.9	5.6	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00128	0.04	CVE-2024-21320

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	185.225.17.53	xyftjms.cn	NetSupport		2019年10月20日	verified	高
2	XXX.XXX.XX.XX	xx-xxxx.xxxxxxxxx.xxx	Xxxxxxxxxx		2019年10月20日	verified	高

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	predictive	高
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
6	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
9	TXXXX	CAPEC-184	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	高
10	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	高
12	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
13	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
14	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (94)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/api/RecordingList/DownloadRecord?file=	predictive	高
2	File	/apply.cgi	predictive	中
3	File	/netflow/jspui/editProfile.jsp	predictive	高
4	File	/php/ping.php	predictive	高
5	File	/rapi/read_url	predictive	高
6	File	/scripts/unlock_tasks.php	predictive	高
7	File	/SysInfo1.htm	predictive	高
8	File	/sysinfo_json.cgi	predictive	高
9	File	/system/user/modules/mod_users/controller.php	predictive	高
10	File	/wp-admin/admin-post.php?es_skip=1&option_name	predictive	高
11	File	appserv/main.php	predictive	高
12	File	xxx-xxx/xxxxx_xxx_xxx	predictive	高
13	File	xxxxxx/xxx.x	predictive	中
14	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
15	File	xxxxxxxxx.xxx.xxx	predictive	高
16	File	xxxxx/xxxxx.xxx	predictive	高
17	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
18	File	xxxx_xxxxx.xxx	predictive	高
19	File	xxxxx.xxx	predictive	中
20	File	xxxxxx.xxx	predictive	中
21	File	xx/xx-xx.x	predictive	中
22	File	xxx/xxxx_xxxx.x	predictive	高
23	File	xxxxxx/xxxxxxxxxxx	predictive	高
24	File	xxxx_xxxxxx.x	predictive	高
25	File	xxxx/xxxxxxx.x	predictive	高
26	File	xxx/xxxxxx.xxx	predictive	高
27	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	高
28	File	xxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxx	predictive	高
29	File	xxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxx	predictive	高
30	File	xxxxx.xxx	predictive	中
31	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	predictive	高
32	File	xxxxxxxxxx.xxx	predictive	高
33	File	xxxxxx_xxxx_xxxxxxx.xxx	predictive	高
34	File	xxxxx.xxx	predictive	中
35	File	xxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	高
36	File	xxx/xxx.xxx	predictive	中
37	File	xxxx_xxxxxxx.xxx	predictive	高
38	File	xxx%xx.xxx	predictive	中
39	File	xxxxxx.x	predictive	中
40	File	xxxx.xxx	predictive	中
41	File	xxxxx.xxx	predictive	中
42	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	predictive	高
43	File	xxxxxxxx.xxx	predictive	中
44	File	xxxx.xxx	predictive	中
45	File	xxxxx/xxxxx.xxx	predictive	高
46	File	xxxxxxxx.xxx	predictive	中
47	File	xxxxxxxxx.xxx	predictive	高
48	File	xxxxxxxxx.xxx	predictive	高
49	File	xxxx.x	predictive	低
50	File	xxxxxxxxxx	predictive	中
51	File	xxxxxxx/xxxxx.xxx	predictive	高
52	Argument	xxxxxx	predictive	低
53	Argument	xxxxxxx_xxxx	predictive	中
54	Argument	xxxxxx_xxxx	predictive	中
55	Argument	xxxxxxxx	predictive	中
56	Argument	xxx	predictive	低
57	Argument	xxxxxxxxxxxxxxxxx	predictive	高
58	Argument	xxxxx	predictive	低
59	Argument	xxxxxxxxxxx/xxxxxxxx/xxx/xxxxx	predictive	高
60	Argument	xxxxxx_xx	predictive	中
61	Argument	xxxx	predictive	低
62	Argument	xxxxxx	predictive	低
63	Argument	xxxx	predictive	低
64	Argument	xxxx	predictive	低
65	Argument	xx	predictive	低
66	Argument	xxxxx_xxxx	predictive	中
67	Argument	xxxxxxxx[xx]	predictive	中
68	Argument	xxx	predictive	低
69	Argument	xxxxxxx	predictive	低
70	Argument	xxx_xxxx	predictive	中
71	Argument	xxxx_xxxxx	predictive	中
72	Argument	xxxxxxxx	predictive	中
73	Argument	xxxxxxx/xxxxx	predictive	高
74	Argument	xxxxxxxxxx	predictive	中
75	Argument	xxxxxx_xxx	predictive	中
76	Argument	xxxx_xx	predictive	低
77	Argument	xxxxxxxx_xxxxxxxx	predictive	高
78	Argument	xxxxxxxxxxxxxxxxxxxxx	predictive	高
79	Argument	xxxx_xx	predictive	低
80	Argument	xxx	predictive	低
81	Argument	xxxx	predictive	低
82	Argument	xxxxxxxx	predictive	中
83	Argument	xxxxxxxx	predictive	中
84	Argument	xxxx/xx/xxxx/xxx	predictive	高
85	Input Value	.%xx.../.%xx.../	predictive	高
86	Input Value	../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxx	predictive	高
87	Input Value	xxxxxxx -xxx	predictive	中
88	Input Value	xxxxxxxxxx	predictive	中
89	Network Port	xxxx	predictive	低
90	Network Port	xxxx	predictive	低
91	Network Port	xxxx xxxx	predictive	中
92	Network Port	xxx/xxx	predictive	低
93	Network Port	xxx/xxx	predictive	低
94	Network Port	xxx/xxxx	predictive	中

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Might our Artificial Intelligence support you?

Check our Alexa App!