Dfni تحليل

IOB - Indicator of Behavior (31)

التسلسل الزمني

اللغة

en28
es2
ru2

البلد

us18
ua12
ru2

الفاعلين

النشاطات

الاهتمام

التسلسل الزمني

النوع

المجهز

منتج

ThinkPHP2
User Post Gallery Plugin2
APC Switched Rack Pdu2
Supermicro H8dgu-f2
Omron CX-One CX-Programmer2

الثغرات

#الثغرةBaseTemp0dayاليومق�معالجةCTIEPSSCVE
1IBM Security AppScan Enterprise Enterprise Source Database تشفير ضعيف9.88.5$5k-$25kجاري الحسابUnprovenOfficial Fix0.000.00082CVE-2013-3989
2raspap-webgui activate_ovpncfg.php تجاوز الصلاحيات8.08.0$0-$5k$0-$5kNot DefinedNot Defined0.000.86945CVE-2022-39986
3PHP Everywhere Plugin Shortcode Privilege Escalation6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00108CVE-2022-24663
4Add Link to Facebook Plugin profile.php سكربتات مشتركة4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.030.00057CVE-2018-5214
5openmosix libmosix.c this تلف الذاكرة4.04.0$0-$5k$0-$5kNot DefinedNot Defined0.000.00042CVE-2008-1865
6User Post Gallery Plugin تجاوز الصلاحيات8.58.4$0-$5k$0-$5kNot DefinedNot Defined0.000.03753CVE-2022-4060
7eSST Monitoring تجاوز الصلاحيات7.57.4$0-$5k$0-$5kNot DefinedNot Defined0.000.00116CVE-2023-41631
8Boa Web Server HEAD Method تجاوز الصلاحيات6.36.2$0-$5k$0-$5kNot DefinedNot Defined0.020.00112CVE-2022-45956
9GitLab Privilege Escalation5.15.0$0-$5k$0-$5kNot DefinedOfficial Fix0.040.00118CVE-2021-22263
10ThinkPHP تجاوز الصلاحيات7.17.1$0-$5k$0-$5kNot DefinedNot Defined0.080.00058CVE-2022-44289
11SuiteCRM Accounts/Contacts/Opportunities/Leads تجاوز الصلاحيات6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.000.00063CVE-2020-15301
12cocoapods-downloader تجاوز الصلاحيات6.86.7$0-$5kجاري الحسابNot DefinedOfficial Fix0.000.00131CVE-2022-21223
13PHP Everywhere Plugin Metabox Privilege Escalation8.88.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00108CVE-2022-24664
14APC UPS Network Management Card 2 AOS Remote Monitoring Credentials الكشف عن المعلومات7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.040.00222CVE-2018-7820
15APC Switched Rack Pdu توثيق ضعيف7.56.6$0-$5k$0-$5kUnprovenUnavailable0.020.01263CVE-2007-6226
16Dropbear SSH dropbearconvert تجاوز الصلاحيات8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00956CVE-2016-7407
17Dropbear SSH تجاوز الصلاحيات8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.000.02911CVE-2016-7406
18Supermicro H8dgu-f Intelligent Platform Management Interface PrivilegeCallBack تجاوز الصلاحيات9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.000.01615CVE-2013-3609
19Drupal تجاوز الصلاحيات5.85.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00088CVE-2017-6928
20D-Link DCS-930L/DCS-932L Authentication الكشف عن المعلومات5.34.8$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.020.00000

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDعنوان بروتوكول الإنترنتHostnameممثلحملاتIdentifiedالنوعالثقة
15.149.248.134Dfni08/04/2022verifiedعالي
2XXX.XXX.XXX.XXxxxxxx.xx.xxx.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxx08/04/2022verifiedعالي

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueالثغراتمتجه الوصولالنوعالثقة
1T1059CWE-88Argument Injectionpredictiveعالي
2T1059.007CWE-79Cross Site Scriptingpredictiveعالي
3TXXXXCWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxxpredictiveعالي
4TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxxpredictiveعالي
5TXXXXCWE-XXXxx Xxxxxxxxxpredictiveعالي
6TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxxxxpredictiveعالي
7TXXXXCWE-XXXXxxxxxxxxxx Xxxxxxxxxxpredictiveعالي
8TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxxpredictiveعالي
9TXXXXCWE-XXXXxxxxxxxxxxxx Xxxxxxpredictiveعالي
10TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxxpredictiveعالي

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDالفئةIndicatorالنوعالثقة
1File/ajax/openvpn/activate_ovpncfg.phppredictiveعالي
2FileFlexCell.ocxpredictiveمتوسط
3Filexxxxxxxx.xpredictiveمتوسط
4Filexxxxx-xxxxxxx.xxxpredictiveعالي
5Filexx-xxxxx/xxxxxxx.xxxpredictiveعالي
6Libraryxxx/xxxxxxx-xxxxxxxxx-x.x.x.xxxpredictiveعالي
7Argumentxxxxx_xxxxxxxx_xxpredictiveعالي
8Argumentxxx_xxpredictiveواطئ
9Argumentxxpredictiveواطئ
10Argumentxxxxpredictiveواطئ
11Argumentxxx_xxpredictiveواطئ
12Argumentxxxxpredictiveواطئ
13Argumentxxxxxxxx/xxxxpredictiveعالي

المصادر (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!