MirrorBlast Analyse

IOB - Indicator of Behavior (626)

Chronologie

Langue

en528
zh36
ru24
es14
de6

De campagne

sc184
us170
cn104
ru38
de20

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Microsoft Windows18
F5 BIG-IP10
Google Chrome10
Circontrol CirCarLife10
Microsoft Exchange Server8

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConEPSSCTICVE
1Atmail Remote Code Execution9.89.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002510.04CVE-2013-5033
2spring-boot-actuator-logview LogViewEndpoint.view directory traversal5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.000490.05CVE-2023-29986
3Esoftpro Online Guestbook Pro ogp_show.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.001080.86CVE-2009-4935
4Apache HTTP Server elévation de privilèges5.35.1$5k-$25k$5k-$25kNot DefinedNot Defined0.000430.08CVE-2023-38709
5Palo Alto PAN-OS GlobalProtect Clientless VPN buffer overflow8.88.6$0-$5k$0-$5kNot DefinedOfficial Fix0.001120.03CVE-2021-3056
6WordPress sql injection6.86.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.004670.00CVE-2022-21664
7Daemon-tools DAEMON Tools mfc80loc.dll elévation de privilèges8.47.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.000450.00CVE-2010-5239
8Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash divulgation de l'information5.35.2$5k-$25k$0-$5kHighWorkaround0.020160.02CVE-2007-1192
9Joomla CMS com_easyblog sql injection6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined0.000000.35
10Microsoft Exchange Server ProxyShell Remote Code Execution9.58.2$25k-$100k$5k-$25kUnprovenOfficial Fix0.973190.00CVE-2021-34473
11VeronaLabs wp-statistics Plugin API Endpoint Blind sql injection8.58.4$0-$5k$0-$5kNot DefinedOfficial Fix0.002500.00CVE-2019-13275
12Jetty URI elévation de privilèges5.35.3$0-$5k$0-$5kNot DefinedOfficial Fix0.475550.00CVE-2021-34429
13Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.17CVE-2017-0055
14phpMyAdmin Username sql injection7.57.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.003260.03CVE-2016-9864
15HP Router/Switch SNMP divulgation de l'information3.73.4$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.002850.04CVE-2012-3268
16SAP GUI TabOne ActiveX Control buffer overflow7.36.4$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.816030.03CVE-2008-4827
17Cisco Linksys Router tmUnblock.cgi elévation de privilèges9.89.2$25k-$100k$0-$5kHighWorkaround0.000000.00
18Linksys WRT54GL Web Management Interface SysInfo1.htm divulgation de l'information4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.000460.04CVE-2024-1406
19Esoftpro Online Guestbook Pro ogp_show.php cross site scripting4.34.2$0-$5k$0-$5kHighUnavailable0.002090.02CVE-2009-2441
20Teclib GLPI unlock_tasks.php sql injection8.58.5$0-$5k$0-$5kNot DefinedOfficial Fix0.121490.08CVE-2019-10232

IOC - Indicator of Compromise (15)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (26)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnérabilitésVecteur d'accèsTaperConfiance
1T1006CWE-21, CWE-22, CWE-23Path TraversalpredictiveÉlevé
2T1040CWE-294Authentication Bypass by Capture-replaypredictiveÉlevé
3T1055CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveÉlevé
4T1059CWE-94, CWE-1321Argument InjectionpredictiveÉlevé
5T1059.007CWE-79, CWE-80Cross Site ScriptingpredictiveÉlevé
6T1068CWE-264, CWE-266, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveÉlevé
7TXXXX.XXXCWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveÉlevé
8TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
9TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveÉlevé
10TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveÉlevé
11TXXXXCWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveÉlevé
12TXXXXCWE-XXXXxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx XxxxxpredictiveÉlevé
13TXXXXCWE-XXXxx XxxxxxxxxpredictiveÉlevé
14TXXXX.XXXCWE-XXXXxxxxxxx XxxxxxxxxxxxxpredictiveÉlevé
15TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
16TXXXXCWE-XXXXxxxxxxxx Xxxxxxx Xx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
17TXXXX.XXXCWE-XXXXxxxxxx Xxxxxxxxxx Xxx Xxxxxxxx Xxxxxxx Xx Xx-xxxx Xxxxxx XxxxxxxxpredictiveÉlevé
18TXXXX.XXXCWE-XXXXxxxxxxxxxxxpredictiveÉlevé
19TXXXXCWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveÉlevé
20TXXXX.XXXCWE-XXXXxxxxxxx Xx Xxx Xxxxxxx Xx X Xxxxxxxx XxxxxxxxpredictiveÉlevé
21TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
22TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
23TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveÉlevé
24TXXXXCWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé
25TXXXX.XXXCWE-XXX, CWE-XXX, CWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveÉlevé
26TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveÉlevé

IOA - Indicator of Attack (222)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File/admin/sysmon.phppredictiveÉlevé
2File/api/content/posts/commentspredictiveÉlevé
3File/api/RecordingList/DownloadRecord?file=predictiveÉlevé
4File/apply.cgipredictiveMoyen
5File/cgi-bin/koha/acqui/supplier.pl?op=enterpredictiveÉlevé
6File/debug/pprofpredictiveMoyen
7File/Home/GetAttachmentpredictiveÉlevé
8File/html/device-idpredictiveÉlevé
9File/html/devstat.htmlpredictiveÉlevé
10File/html/repositorypredictiveÉlevé
11File/index.phppredictiveMoyen
12File/members/view_member.phppredictiveÉlevé
13File/mhds/clinic/view_details.phppredictiveÉlevé
14File/modules/projects/vw_files.phppredictiveÉlevé
15File/nova/bin/consolepredictiveÉlevé
16File/owa/auth/logon.aspxpredictiveÉlevé
17File/php/ping.phppredictiveÉlevé
18File/rapi/read_urlpredictiveÉlevé
19File/rest/api/latest/projectvalidate/keypredictiveÉlevé
20File/scripts/unlock_tasks.phppredictiveÉlevé
21File/services/config/config.xmlpredictiveÉlevé
22File/services/system/setup.jsonpredictiveÉlevé
23File/SSOPOST/metaAlias/%realm%/idpv2predictiveÉlevé
24File/SysInfo1.htmpredictiveÉlevé
25File/sysinfo_json.cgipredictiveÉlevé
26File/xxxxxx/xxxx/xxxxxxx/xxx_xxxxx/xxxxxxxxxx.xxxpredictiveÉlevé
27File/xxxxxxx/predictiveMoyen
28File/xxx-xxx/xxx.xxxpredictiveÉlevé
29File/xx-xxxxx/xxxxx-xxxx.xxx?xx_xxxx=x&xxxxxx_xxxxpredictiveÉlevé
30Filexxxxxxx.xxxpredictiveMoyen
31Filexxxxx.xxxxxxxxx.xxxpredictiveÉlevé
32Filexxxxx/xxxxxx.xxxpredictiveÉlevé
33Filexxxx.xxxpredictiveMoyen
34Filexxxxxxx/xxxx.xxxpredictiveÉlevé
35Filexxx/xxx.xxxpredictiveMoyen
36Filexxx-xxx/xxxx_xxx.xxxpredictiveÉlevé
37Filexxxxxx/xxx.xpredictiveMoyen
38Filexxxxxxx.xxxpredictiveMoyen
39Filexxxxxx.xpredictiveMoyen
40Filexxxx/xxxxx/xxxxxxx/xxxxxxxxx/xxxxxxx/xxxxx/xxx.xxxpredictiveÉlevé
41Filexxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxx/xxx/xxxxxx.xxxxxxxxx.xxxpredictiveÉlevé
42Filexxxxxxxxx.xxx.xxxpredictiveÉlevé
43Filexxxxx/xxxxx.xxxpredictiveÉlevé
44Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveÉlevé
45Filexxxx_xxxxx.xxxpredictiveÉlevé
46Filexxxx/xxxxpredictiveMoyen
47Filexxxxx.xxxpredictiveMoyen
48Filexxxxxx.xxxpredictiveMoyen
49Filexxxxx.xxxpredictiveMoyen
50Filexxxxxx_xxx.xpredictiveMoyen
51Filexxx/xxxx/xxx/xxxxx_xxxx.xpredictiveÉlevé
52Filexxx/xxxx/xxxx.xpredictiveÉlevé
53Filexxxxxxxxxxx/xxxxxxxx/xxxxxxxxxx.xxxpredictiveÉlevé
54Filexxxxxxxxxxxxxx.xxpredictiveÉlevé
55Filexx/xx-xx.xpredictiveMoyen
56Filexxx/xxxx_xxxx.xpredictiveÉlevé
57Filexxxxxx/xxxxxxxxxxxpredictiveÉlevé
58Filexxxx_xxxxxx.xpredictiveÉlevé
59Filexxxx/xxxxxxx.xpredictiveÉlevé
60Filexxxxx.xxxxpredictiveMoyen
61Filexx/xxxxxxx/xxx.xpredictiveÉlevé
62Filexxx/xxxxxx.xxxpredictiveÉlevé
63Filexxx/xx/xxxx/xxxx.xxxxx.xxxpredictiveÉlevé
64Filexxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxxpredictiveÉlevé
65Filexxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxxpredictiveÉlevé
66Filexxxxx.xxxpredictiveMoyen
67Filexxxxx.xxx?xxx=xxxx&xxx=xxxxxxxxpredictiveÉlevé
68Filexxxxxxxx/xx/xxxx.xxpredictiveÉlevé
69Filexxxxxxxxxx.xxxpredictiveÉlevé
70Filexxxxxx.xpredictiveMoyen
71Filexxxxxxxx.xxxpredictiveMoyen
72Filexx/xxx/xxxxxxxx/xxx_xxxxxxxxx/xxx_xxxxxxxx_xxxxx/_/xxxxxxx_xxxpredictiveÉlevé
73Filexxxxxx/xxxxxx.xpredictiveÉlevé
74Filexxxxxxx/xxxxx/xx/xxxxxx/xxxxx.xxxxx.xxxpredictiveÉlevé
75Filexxxxxxxxxxxx/xxx.xpredictiveÉlevé
76Filexxxxx.xxxpredictiveMoyen
77Filexxx_xxxxxxxxx.xpredictiveÉlevé
78Filexxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxxpredictiveÉlevé
79Filexxxxxxx.xxxpredictiveMoyen
80Filexxx/xxx.xxxpredictiveMoyen
81Filexxx_xxxxx_xxxx.xpredictiveÉlevé
82Filexxx/xxxxxpredictiveMoyen
83Filexxx_xxxx.xxxpredictiveMoyen
84Filexxx_xxxx.xxxpredictiveMoyen
85Filexxxxxxx/xxxxpredictiveMoyen
86Filexxxxxxx.xxxpredictiveMoyen
87Filexxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
88Filexxxx_xxxxxxx.xxxpredictiveÉlevé
89Filexxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
90Filexxxxxx.xpredictiveMoyen
91Filexxxx.xxxpredictiveMoyen
92Filexxxxx.xxxpredictiveMoyen
93Filexxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]predictiveÉlevé
94Filexxxx.xxxpredictiveMoyen
95Filexxxxxxxx.xxpredictiveMoyen
96Filexxxxxxxxxx.xxxpredictiveÉlevé
97Filexxxxxxxx_xxxxxxxxxxxx_xxxxxx.xxpredictiveÉlevé
98Filexxxxxxxxxxx.xxxpredictiveÉlevé
99Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveÉlevé
100Filexxx_xxxxx_xxxxxxxxx.xpredictiveÉlevé
101Filexxxxxxxx.xxxpredictiveMoyen
102Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictiveÉlevé
103Filexxxxx.xxxpredictiveMoyen
104Filexxxx.xxxpredictiveMoyen
105Filexxxxx/xxxxx.xxxpredictiveÉlevé
106Filexxxxxxxxxxxxxxx.xxxpredictiveÉlevé
107Filexxxxxxxx.xxxpredictiveMoyen
108Filexxxxxxxx/xxxxxxxxxxxx-xxxxxxxxxxpredictiveÉlevé
109Filexxxxxx/xxxxxxx/xxxxxx/xxxxxxxx.xxxpredictiveÉlevé
110Filexxxx.xxxpredictiveMoyen
111Filexxxx-xxxxx.xxxpredictiveÉlevé
112Filexxx.xpredictiveFaible
113Filexxxxxxxxx.xxxpredictiveÉlevé
114Filexxxxx/xxx/xxxxxxx/xxxxxx.xxxpredictiveÉlevé
115Filexxxxxx.xxxpredictiveMoyen
116Filexxx xxxx xxxxxxxpredictiveÉlevé
117Filexxxx.xpredictiveFaible
118FilexxxxxxxxxxpredictiveMoyen
119Filexxxxxxx/xxxxx.xxxpredictiveÉlevé
120Filexxxxxx.xxxpredictiveMoyen
121Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveÉlevé
122Filexxxxxxxxxxxxx.xxpredictiveÉlevé
123Library/_xxx_xxx/xxxxx.xxxpredictiveÉlevé
124Libraryxxx-xx-xxx-xxxx-xxxx-xx-x-x.xxxpredictiveÉlevé
125Libraryxxx/xxxxxx.xpredictiveMoyen
126Libraryxxxxxxxxx/xxx-xxxxxx/xxxxxxxx.xxxpredictiveÉlevé
127Libraryxxxxxxxx.xxxpredictiveMoyen
128Libraryxxxxxx/xxxxxxxxx/xxxxx.xxxpredictiveÉlevé
129Libraryxxxxxx.xxxpredictiveMoyen
130Argument-xpredictiveFaible
131Argumentxxxxxxx xx/xxxxxxx xxxxpredictiveÉlevé
132ArgumentxxxxxxpredictiveFaible
133Argumentxxxxxxx_xxxxpredictiveMoyen
134Argumentxxxxxx_xxxxpredictiveMoyen
135ArgumentxxxxxxxxxxxxxxpredictiveÉlevé
136ArgumentxxxxxxxxpredictiveMoyen
137ArgumentxxxpredictiveFaible
138ArgumentxxxxxxxxxxxxxxxpredictiveÉlevé
139ArgumentxxxpredictiveFaible
140ArgumentxxxxxxxxxpredictiveMoyen
141ArgumentxxxxxxxxxxxxxxxxxpredictiveÉlevé
142ArgumentxxxxxxxxxxxxxxxxpredictiveÉlevé
143ArgumentxxxxxpredictiveFaible
144Argumentxxxxxxxxxxx/xxxxxxxx/xxx/xxxxxpredictiveÉlevé
145ArgumentxxxxpredictiveFaible
146Argumentxxxxxx_xxpredictiveMoyen
147ArgumentxxxxxxxpredictiveFaible
148Argumentxxxxxx/xxxxxxxpredictiveÉlevé
149Argumentxxxxxxxx[xxxx_xxx]predictiveÉlevé
150Argumentxxxxx->xxxxpredictiveMoyen
151ArgumentxxxxxpredictiveFaible
152ArgumentxxxxpredictiveFaible
153ArgumentxxxxxxpredictiveFaible
154Argumentxx_xxpredictiveFaible
155Argumentxxxxxxxx xxxx/xxxxxxxx xxxxxxxx/xxxxxxxx xxxxxxx xx/xxxxxxx/xxxxpredictiveÉlevé
156ArgumentxxxxpredictiveFaible
157ArgumentxxxxpredictiveFaible
158ArgumentxxxxxxxxpredictiveMoyen
159ArgumentxxxxpredictiveFaible
160ArgumentxxpredictiveFaible
161Argumentxxxxx_xxxxpredictiveMoyen
162ArgumentxxxxpredictiveFaible
163Argumentxxxxxxxx[xx]predictiveMoyen
164ArgumentxxxpredictiveFaible
165ArgumentxxxxxxxpredictiveFaible
166ArgumentxxxxxxxxpredictiveMoyen
167ArgumentxxxxxxxxxxpredictiveMoyen
168Argumentxxxx_xxx_xxxxxxxx_xxxpredictiveÉlevé
169Argumentxxx_xxxxpredictiveMoyen
170ArgumentxxxxxxpredictiveFaible
171ArgumentxxxxpredictiveFaible
172Argumentxxx_xxxxxxpredictiveMoyen
173ArgumentxxxxxxxpredictiveFaible
174ArgumentxxxxxxxpredictiveFaible
175Argumentxxxx_xxxxxpredictiveMoyen
176ArgumentxxxxxxxxpredictiveMoyen
177ArgumentxxxxxxxxpredictiveMoyen
178ArgumentxxxxpredictiveFaible
179Argumentxxxxxx_xxxxpredictiveMoyen
180ArgumentxxxxxxxpredictiveFaible
181Argumentxxxxxx_xxxxxxxpredictiveÉlevé
182Argumentxxxxxxx/xxxxxpredictiveÉlevé
183Argumentxxxxx/xxxxxxxxpredictiveÉlevé
184ArgumentxxxxxxpredictiveFaible
185ArgumentxxxxxpredictiveFaible
186ArgumentxxxxxxxxxxxpredictiveMoyen
187Argumentxxxxxx_xxxpredictiveMoyen
188ArgumentxxxpredictiveFaible
189Argumentxxxx_xxpredictiveFaible
190Argumentxxxxxxxx_xxxxxxxxpredictiveÉlevé
191Argumentxx_xxx_xxxxxpredictiveMoyen
192ArgumentxxxpredictiveFaible
193ArgumentxxxxxxxxxxxxxxxxxxxxxpredictiveÉlevé
194Argumentxxxx_xxpredictiveFaible
195ArgumentxxxpredictiveFaible
196ArgumentxxxpredictiveFaible
197ArgumentxxxxpredictiveFaible
198ArgumentxxxxxxxxpredictiveMoyen
199ArgumentxxxxxpredictiveFaible
200Argumentxxxx/xx/xxxx/xxxpredictiveÉlevé
201ArgumentxxxxxxxxxpredictiveMoyen
202Argumentx-xxxxxxxxx-xxxxxxpredictiveÉlevé
203Input Value.%xx.../.%xx.../predictiveÉlevé
204Input Value../predictiveFaible
205Input Value../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxxpredictiveÉlevé
206Input ValuexxxxxpredictiveFaible
207Input Valuexxxxx' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxx&xxxxxxxx=xxxxxxxxxxpredictiveÉlevé
208Input Valuexxxxxxx -xxxpredictiveMoyen
209Input ValuexxxxxxxxxxpredictiveMoyen
210Input Value\xpredictiveFaible
211Input Value|<xxxxxxx>predictiveMoyen
212Patternxxxxxx.xxxxxxpredictiveÉlevé
213Network PortxxxxpredictiveFaible
214Network PortxxxxpredictiveFaible
215Network Portxxxx xxxxpredictiveMoyen
216Network Portxxx/xxpredictiveFaible
217Network Portxxx/xxxpredictiveFaible
218Network Portxxx/xxxpredictiveFaible
219Network Portxxx/xxxx (xxx)predictiveÉlevé
220Network Portxxx/xxxxpredictiveMoyen
221Network Portxxx/xxxxpredictiveMoyen
222Network Portxxx/xxx (xxxx)predictiveÉlevé

Références (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!