SideCopy Analyse

IOB - Indicator of Behavior (1000)

Chronologie

Langue

en816
zh54
pt54
de20
ar14

De campagne

nl876
pt52
us34
de2
fr2

Acteurs

Activités

Intérêt

Chronologie

Taper

Fournisseur

Produit

Microsoft Windows112
Linux Kernel22
Google Android18
WordPress12
Microsoft Exchange Server10

Vulnérabilités

#VulnérabilitéBaseTemp0dayAujourd'huiExpConEPSSCTICVE
1nginx elévation de privilèges6.96.9$0-$5k$0-$5kNot DefinedNot Defined0.002413.47CVE-2020-12440
2Huawei ACXXXX/SXXXX SSH Packet elévation de privilèges7.57.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.002460.07CVE-2014-8572
3Microsoft Windows WPAD elévation de privilèges8.07.9$25k-$100k$0-$5kHighOfficial Fix0.909620.03CVE-2016-3213
4Microsoft Windows Graphics Remote Code Execution7.06.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.035230.00CVE-2021-34530
5Microsoft Windows Event Tracing Privilege Escalation7.36.3$25k-$100k$5k-$25kUnprovenOfficial Fix0.000430.00CVE-2021-34487
6Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.005480.11CVE-2017-0055
7Cisco Secure Email and Web Manager Web-based Management Interface authentification faible9.89.6$25k-$100k$5k-$25kNot DefinedOfficial Fix0.003370.02CVE-2022-20798
8nginx Log File elévation de privilèges7.87.4$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000920.04CVE-2016-1247
9Apache HTTP Server mod_rewrite Redirect6.76.7$25k-$100k$5k-$25kNot DefinedNot Defined0.002580.04CVE-2020-1927
10Microsoft .NET Core/Visual Studio dénie de service6.45.5$5k-$25k$0-$5kUnprovenOfficial Fix0.001950.09CVE-2021-26423
11Microsoft Windows TCP/IP Stack Privilege Escalation9.98.6$100k et plus$5k-$25kUnprovenOfficial Fix0.021830.04CVE-2021-26424
12Microsoft Windows Event Tracing Privilege Escalation8.37.3$100k et plus$5k-$25kUnprovenOfficial Fix0.000440.00CVE-2021-26425
13Microsoft Windows Bluetooth Driver Privilege Escalation8.37.3$100k et plus$5k-$25kUnprovenOfficial Fix0.000430.00CVE-2021-34537
14Microsoft Dynamics 365 Privilege Escalation8.57.4$25k-$100k$0-$5kUnprovenOfficial Fix0.007360.00CVE-2021-34524
15Microsoft Windows Storage Spaces Controller Local Privilege Escalation7.86.8$25k-$100k$5k-$25kUnprovenOfficial Fix0.000430.04CVE-2021-34536
16Microsoft Windows Graphics Remote Code Execution7.06.1$25k-$100k$5k-$25kUnprovenOfficial Fix0.035230.00CVE-2021-34533
17Microsoft Windows Services for NFS ONCRPC XDR Driver divulgation de l'information6.45.5$25k-$100k$5k-$25kUnprovenOfficial Fix0.011080.03CVE-2021-36926
18Microsoft ASP.NET Core/Visual Studio divulgation de l'information4.94.3$5k-$25k$0-$5kUnprovenOfficial Fix0.000430.00CVE-2021-34532
19Microsoft Windows Services for NFS ONCRPC XDR Driver divulgation de l'information6.45.5$25k-$100k$5k-$25kUnprovenOfficial Fix0.011080.00CVE-2021-36933
20Microsoft Windows Remote Desktop Client Remote Code Execution8.87.9$100k et plus$5k-$25kProof-of-ConceptOfficial Fix0.052520.02CVE-2021-34535

IOC - Indicator of Compromise (18)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClasseVulnérabilitésVecteur d'accèsTaperConfiance
1T1006CAPEC-126CWE-21, CWE-22, CWE-23Path TraversalpredictiveÉlevé
2T1040CAPEC-102CWE-294Authentication Bypass by Capture-replaypredictiveÉlevé
3T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveÉlevé
4T1059CAPEC-242CWE-94Argument InjectionpredictiveÉlevé
5TXXXX.XXXCAPEC-209CWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveÉlevé
6TXXXXCAPEC-122CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
7TXXXX.XXXCAPEC-16CWE-XXX, CWE-XXXXxxx-xxxxx XxxxxxxxxxxpredictiveÉlevé
8TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveÉlevé
9TXXXX.XXXCAPEC-178CWE-XXXXxxx XxxxxxxxpredictiveÉlevé
10TXXXXCAPEC-0CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveÉlevé
11TXXXXCAPEC-0CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxx XxxxxxpredictiveÉlevé
12TXXXXCAPEC-108CWE-XX, CWE-XXXxx XxxxxxxxxpredictiveÉlevé
13TXXXXCAPEC-102CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
14TXXXXCAPEC-38CWE-XXX, CWE-XXXXxxxxxxxx Xxxxxx XxxxpredictiveÉlevé
15TXXXX.XXXCAPEC-459CWE-XXXXxxxxxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveÉlevé
16TXXXXCAPEC-116CWE-XXX, CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveÉlevé
17TXXXX.XXXCAPEC-0CWE-XXXxxxxxxxxxxxxpredictiveÉlevé
18TXXXXCAPEC-157CWE-XXX, CWE-XXX, CWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveÉlevé
19TXXXX.XXXCAPEC-112CWE-XXX, CWE-XXXXxx Xxxxxxxxxx XxxxxpredictiveÉlevé
20TXXXX.XXXCAPEC-1CWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx XxxxxxxxxpredictiveÉlevé

IOA - Indicator of Attack (242)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorTaperConfiance
1File.travis.ymlpredictiveMoyen
2File/.envpredictiveFaible
3File/admin.phppredictiveMoyen
4File/admin/?page=inmates/view_inmatepredictiveÉlevé
5File/admin/subnets/ripe-query.phppredictiveÉlevé
6File/apply.cgipredictiveMoyen
7File/core/conditions/AbstractWrapper.javapredictiveÉlevé
8File/debug/pprofpredictiveMoyen
9File/defaultui/player/modern.htmlpredictiveÉlevé
10File/dvcset/sysset/set.cgipredictiveÉlevé
11File/edit-db.phppredictiveMoyen
12File/exportpredictiveFaible
13File/file?action=download&filepredictiveÉlevé
14File/forum/away.phppredictiveÉlevé
15File/goform/aspFormpredictiveÉlevé
16File/hardwarepredictiveMoyen
17File/installers/common.shpredictiveÉlevé
18File/librarian/bookdetails.phppredictiveÉlevé
19File/medical/inventories.phppredictiveÉlevé
20File/monitoringpredictiveMoyen
21File/opt/zimbra/jetty/webapps/zimbra/publicpredictiveÉlevé
22File/plugin/LiveChat/getChat.json.phppredictiveÉlevé
23File/plugins/servlet/audit/resourcepredictiveÉlevé
24File/plugins/servlet/project-config/PROJECT/rolespredictiveÉlevé
25File/procpredictiveFaible
26File/replicationpredictiveMoyen
27File/RestAPIpredictiveMoyen
28File/xxx/xxxxxx-xxxxxxxx-*predictiveÉlevé
29File/xxxxxxx/predictiveMoyen
30File/xxxxxxpredictiveFaible
31File/xxxx/xxxxxx.xxx?xxx=xpredictiveÉlevé
32File/xxx/xxx/xxxxxpredictiveÉlevé
33File/xxx/xxx/xxxxxxxx.xxxpredictiveÉlevé
34File/xxxxxx/xxxxxx.xxxxpredictiveÉlevé
35File/xxxxxxxx_xxxxx/xxxxxxx/xxxxxx.xxx?x=xxxxxx_xxxxxpredictiveÉlevé
36File/xx-xxxx/xxxxxx/x.x/xxxxx?xxxpredictiveÉlevé
37Filexxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
38Filexxxxxxx.xxxpredictiveMoyen
39Filexxxxxxx.xxxpredictiveMoyen
40Filexxx.xxxpredictiveFaible
41Filexxxxxxx.xxxpredictiveMoyen
42Filexxx/xxx/xxxx-xxxpredictiveÉlevé
43Filexxxxx.xxxpredictiveMoyen
44Filexxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
45Filexxxx/xxxxxxx/xxx/xxxxxx_xxxx.xpredictiveÉlevé
46Filexxxx-xxxx.xpredictiveMoyen
47Filexxxx/xxxxxxx.xxxpredictiveÉlevé
48Filex/xxxxxx/xxxxx.xxxpredictiveÉlevé
49Filex:\xxxxxxx xxxxx\xxxxxx xxxxx\xxx\xxxxxxx.xxxpredictiveÉlevé
50Filex:\xxxxxxx\xxxxxxxx\xxxxxx\xxxpredictiveÉlevé
51Filexxx-xxx/xx.xxxpredictiveÉlevé
52Filexxx/xxxxxxx.xxpredictiveÉlevé
53Filexxxxx.xxxpredictiveMoyen
54Filexxxxxx.xxxpredictiveMoyen
55Filexxx_xxxxxx.xxxpredictiveÉlevé
56Filexxx.xxxpredictiveFaible
57Filexxxxxxx.xxxpredictiveMoyen
58Filexxxxxx.xxxpredictiveMoyen
59Filexxxxxxxxxx/xxxxxx/xxxxxxxxx.xxxx/xxxx.xxx/predictiveÉlevé
60Filex_xxxxxxpredictiveMoyen
61Filexxxxxxx.xxxpredictiveMoyen
62Filexxxx_xxxxxx.xxxpredictiveÉlevé
63Filexxxxxxx/xxxxx/xxxxxx.xpredictiveÉlevé
64Filexxxxxxx/xxx/xxxxxxx/xxxx.xpredictiveÉlevé
65Filexxxx_xxxxx.xxxpredictiveÉlevé
66Filexxxxxxxxxxx.xxxpredictiveÉlevé
67Filexxx/xxxxxxxx/xxxx.xpredictiveÉlevé
68Filexxx/xxxxxxxx/xxx_xxxxxxxxxxxx.xpredictiveÉlevé
69Filexxxxxxxx.xpredictiveMoyen
70Filexx/xxxxxxxxx.xpredictiveÉlevé
71Filexx/xxxxx.xpredictiveMoyen
72Filexx/xxxxx/xxxxxxx.xpredictiveÉlevé
73Filexxxxx.xxxpredictiveMoyen
74Filexxxxxx.xxxpredictiveMoyen
75Filexxxxxxxxxx.xxpredictiveÉlevé
76Filexxxxxxxxxxxxx.xxxxpredictiveÉlevé
77Filexxxx/xxxxxxxxxxxxxxxxxxxxxxxx.xxpredictiveÉlevé
78Filexxxxx-xxxxx.xpredictiveÉlevé
79Filexxxxxx_xxxxx_xxxxxxx.xpredictiveÉlevé
80Filexxxxx-xxxxxxxxxx.xpredictiveÉlevé
81Filexxx/xxxxxx.xxxpredictiveÉlevé
82Filexxxxx.xxxpredictiveMoyen
83Filexxxxx:/xxxxxxxx/xxxxxxxxxxxx.xxxxpredictiveÉlevé
84Filexxxxx/xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictiveÉlevé
85Filexxxx_xxxx.xxxpredictiveÉlevé
86Filexxxx_xxxx.xxxpredictiveÉlevé
87Filexxxx_xxxxxx.xxpredictiveÉlevé
88Filexxxxxx/xxx/xxxxxxxx.xpredictiveÉlevé
89Filexxxxxx/xxxxx/xxxxx_xxxxxx_xxxxxx.xpredictiveÉlevé
90Filexxxxxxx/xx_xxx.xpredictiveÉlevé
91Filexxxxxxxxx/xxxxxxx/xxxxxx/xxxxxxxxxx.xxxpredictiveÉlevé
92Filexxxx.xxxpredictiveMoyen
93Filexxxxx.xxxpredictiveMoyen
94Filexxxxx.xxxpredictiveMoyen
95Filexxxxx/predictiveFaible
96Filexxxxxxxxxx/xxxxxxxx.xpredictiveÉlevé
97Filexxxxxxxxxx/xxx.xpredictiveÉlevé
98Filexxxx.xpredictiveFaible
99Filexxxx.xxxpredictiveMoyen
100Filexxxxxx_xxxxx_xxxxxxx.xpredictiveÉlevé
101Filexxxxxxxxxxxxxxxx.xpredictiveÉlevé
102Filexxx/xxxxxxxxx/xx_xxxxxx_xxx.xpredictiveÉlevé
103Filexxx/xxxxxxxxx/x_xxxxxx.xpredictiveÉlevé
104Filexxxx.xxxpredictiveMoyen
105Filexxx_xxxxxxx.xpredictiveÉlevé
106Filexxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveÉlevé
107Filexxx_xx.xpredictiveMoyen
108Filexxxxxxxxxxxxxxxxx.xxxpredictiveÉlevé
109Filexxxx_xxxxxx.xpredictiveÉlevé
110Filexxxxxxxxx.xxx.xxxpredictiveÉlevé
111Filexxxxxxx.xxxpredictiveMoyen
112Filexxxxxxxx.xxxxpredictiveÉlevé
113Filexxxxxxxxxxxxx.xxxxpredictiveÉlevé
114Filexxxxxx.xpredictiveMoyen
115Filexxxxxxxxxxxxx.xxxpredictiveÉlevé
116Filexxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]predictiveÉlevé
117Filexxxxxxxx.xxxpredictiveMoyen
118Filexxxxxxx.xxxpredictiveMoyen
119Filexxxxx.xxxpredictiveMoyen
120Filexxxxxxxx.xxxpredictiveMoyen
121Filexxxxxxx.xpredictiveMoyen
122Filexxxxxxxxxx_xxxxx.xxxxxxpredictiveÉlevé
123Filexxxx_xxx_xx.xpredictiveÉlevé
124Filexx_xxx.xpredictiveMoyen
125Filexxxxxx.xpredictiveMoyen
126Filexxxxx.xxxpredictiveMoyen
127Filexxxx-xxxxxx.xpredictiveÉlevé
128Filexxxxxxx.xpredictiveMoyen
129Filexxx/xxx_xxxxx.xpredictiveÉlevé
130Filexxxxxxx.xxxpredictiveMoyen
131Filexxxxxxx.xxx.xx.xxxxxxxxxxx.xxxpredictiveÉlevé
132Filexxx_xxx.xpredictiveMoyen
133Filexxxx-xxxxx.xxxpredictiveÉlevé
134Filexxxxxxx/xxxxxxx/xxxxxx/xxxxxx_xxxx.xxxpredictiveÉlevé
135Filexxxx.xxxxxxxxx.xxxpredictiveÉlevé
136Filexxxx_xxxx.xxxpredictiveÉlevé
137Filexxxxxx.xxxpredictiveMoyen
138Filexxx.xxxpredictiveFaible
139Filexxx.xxxxxxpredictiveMoyen
140Filexxxxxx/xx/xxxx.xxxpredictiveÉlevé
141Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictiveÉlevé
142Filexx-xxxxxxxx/xxxxxxx-xxxxxxxx.xxxpredictiveÉlevé
143Filexx-xxxxxxxx/xxxx.xxxpredictiveÉlevé
144Filexx/xx/xxxxxpredictiveMoyen
145Filexx_xxxxxxx.xpredictiveMoyen
146File_xxxxxxxx/xxxxxxxx.xxxpredictiveÉlevé
147File~/xxxx/xxx/xxxxxxx/xxxxxxxxxx/xxxxxx.xxxpredictiveÉlevé
148Libraryxxxxx/xxxxxxxxx/xxxx.xxxxxxxxx.xxxpredictiveÉlevé
149Libraryxxxxxxxxxx/xxxxxxxx.xpredictiveÉlevé
150Libraryxxxxxxxx.xxxpredictiveMoyen
151Libraryxxxxxxxxx.xxxpredictiveÉlevé
152Libraryxxxxxxxx.xxxpredictiveMoyen
153Libraryxxxxxx.xxx.xxx.xxxpredictiveÉlevé
154Libraryxxxxxxxx.xxxpredictiveMoyen
155Libraryxxxxx.xxxpredictiveMoyen
156Libraryxxxxxxxx.xxxpredictiveMoyen
157Libraryxxxxxxxx.xxxpredictiveMoyen
158Argument-xpredictiveFaible
159Argumentxxxxx.xxxxxxxxpredictiveÉlevé
160Argumentxxxxxx_xxxxpredictiveMoyen
161ArgumentxxxxxxxxpredictiveMoyen
162ArgumentxxxpredictiveFaible
163ArgumentxxxxxpredictiveFaible
164Argumentxxx_xxpredictiveFaible
165Argumentxxxx_xxpredictiveFaible
166ArgumentxxxxxxpredictiveFaible
167Argumentxxxxxxx xxxxpredictiveMoyen
168ArgumentxxxxxxxxxxpredictiveMoyen
169ArgumentxxxxxxxpredictiveFaible
170Argumentxxxxxxx_xxxx->xxx($xxxxxxxx)predictiveÉlevé
171ArgumentxxxxxpredictiveFaible
172Argumentxxxxxx_xxxxpredictiveMoyen
173ArgumentxxxxxxxpredictiveFaible
174Argumentxxxx_xxpredictiveFaible
175ArgumentxxxxpredictiveFaible
176ArgumentxxxxxxxxpredictiveMoyen
177ArgumentxxpredictiveFaible
178ArgumentxxpredictiveFaible
179ArgumentxxxxxxxxxxxxxxpredictiveÉlevé
180ArgumentxxxxxxxpredictiveFaible
181Argumentxxxxx[xxxxx][xx]predictiveÉlevé
182Argumentxxxx_xxxxxx_xxxxpredictiveÉlevé
183Argumentxxxx x xxxxpredictiveMoyen
184Argumentxxxxxxxxx/xxxxxxxxxpredictiveÉlevé
185ArgumentxxxxpredictiveFaible
186ArgumentxxxxxxxxxxxxxxxxxxxxpredictiveÉlevé
187ArgumentxxpredictiveFaible
188Argumentxxxxxxx/xxxx/xxxxxxxxpredictiveÉlevé
189Argumentxxxxx/xxxxxxpredictiveMoyen
190ArgumentxxxxpredictiveFaible
191ArgumentxxxxxxxxpredictiveMoyen
192ArgumentxxxxxxxxpredictiveMoyen
193ArgumentxxxxxxxxpredictiveMoyen
194ArgumentxxxxxxxxxpredictiveMoyen
195Argumentxxx_xxxpredictiveFaible
196ArgumentxxxxxxxxxxxxxpredictiveÉlevé
197ArgumentxxxxxxpredictiveFaible
198ArgumentxxxxxxxpredictiveFaible
199Argumentxx_xxxxxxx_xxxxxxxpredictiveÉlevé
200ArgumentxxxxxxxxxxxxxpredictiveÉlevé
201ArgumentxxxxxpredictiveFaible
202Argumentxxxxxxx_xxxpredictiveMoyen
203ArgumentxxxxpredictiveFaible
204ArgumentxxxxxxxxxxxxxpredictiveÉlevé
205ArgumentxxxxxxxpredictiveFaible
206ArgumentxxxxxxpredictiveFaible
207Argumentxxxxxxxx_xxxxxpredictiveÉlevé
208ArgumentxxxxxxxxxxxxpredictiveMoyen
209ArgumentxxxxxxpredictiveFaible
210ArgumentxxxxxpredictiveFaible
211ArgumentxxxpredictiveFaible
212Argumentxxx/xxxxxxxpredictiveMoyen
213ArgumentxxxxxxpredictiveFaible
214ArgumentxxxpredictiveFaible
215Argumentxxxxxxxx-xxxxxxxxpredictiveÉlevé
216ArgumentxxxxxxxxxxxxxxpredictiveÉlevé
217ArgumentxxxpredictiveFaible
218ArgumentxxxxpredictiveFaible
219ArgumentxxxxxxxxpredictiveMoyen
220ArgumentxxxxxxxpredictiveFaible
221Argumentxxxx->xxxxxxxpredictiveÉlevé
222Argumentx-xxxxxxxxx-xxxpredictiveÉlevé
223ArgumentxxxpredictiveFaible
224Argument_xxx_xxxxxxx_xxxxxxx_xxxxxxxxxxxxx_xxx_xxx_xxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_xxxxxxxxxxxxxxxpredictiveÉlevé
225Argument_xxx_xxxxxxxxxxx_predictiveÉlevé
226Input Value' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxxpredictiveÉlevé
227Input Value.%xx.../.%xx.../predictiveÉlevé
228Input Value//predictiveFaible
229Input Valuexxx xxxxxxxxpredictiveMoyen
230Input Valuex%xx%xxxxx%xxx=x%xxxxxxx%xxxxxxxx%xxx,xxxx(),x,x,x,x,x,x,x,x,xxxxxxxx(),x,x,x,x,x,x,x,x,x,x,x,x,x--+predictiveÉlevé
231Input ValuexxxxxxxxpredictiveMoyen
232Input Valuexxxxxxxxx' xxx 'x'='xpredictiveÉlevé
233Input ValuexxxxxpredictiveFaible
234Input Valuexxxxxxx_xxxxx.xxxxxxx_xxxxxxxpredictiveÉlevé
235Input Value\xpredictiveFaible
236Input Value….//predictiveFaible
237Pattern|xx|predictiveFaible
238Network PortxxxxxpredictiveFaible
239Network Portxx xxxxxxx xxx.xx.xx.xxpredictiveÉlevé
240Network Portxxxxx xxx-xxx, xxxpredictiveÉlevé
241Network Portxxx/xx (xxxxxx)predictiveÉlevé
242Network Portxxx xxxxxx xxxxpredictiveÉlevé

Références (7)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!