4 Commits

Author	SHA1	Message	Date
Jonhnathan	4cf147b93e	[Rule Tuning] Windows High-Severity Rules Revamp - 12 (#6031) ... * [Rule Tuning] Windows High-Severity Rules Revamp - 12 * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml * Update initial_access_suspicious_ms_exchange_worker_child_process.toml * ++ * Update privilege_escalation_user_added_to_admin_group.toml (cherry picked from commit f3328c4b25)	2026-05-12 15:38:06 +00:00
Mika Ayenson, PhD	b322b7505c	[Rule Tuning] Add Supplemental Mitre Mappings (#5876) ... --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co> (cherry picked from commit 8993d1450b)	2026-04-01 14:16:50 +00:00
Samirbous	553f614564	[Tuning/New] Solarwinds Post Exploit (#5696) ... * [Tuning/New] Solawrwinds Post Exploit https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399 - new rule for tunneling using QEMU - added few websvc domains .cloud.es.io, files.catbox.moe and supabase.co - added javaw to the solarwinds rule - added ZOHO and Velociraptor to the new term RMM rule. * Update initial_access_potential_webhelpdesk_exploit.toml * Update rules/windows/command_and_control_common_webservices.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * ++ --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> (cherry picked from commit 2b5472a9b3)	2026-02-09 14:46:09 +00:00
Samirbous	c6923ecd3b	[New] SolarWinds Web Help Desk Java Module Load or Child Process (#5665) ... * [New] Suspicious SolarWinds Web Help Desk Java Module Load or Child Process Identifies the SolarWinds Web Help Desk Java process loading an untrusted or remote native module (DLL). This behavior is uncommon for the Web Help Desk server and may indicate successful exploitation of deserialization vulnerabilities (CVE-2025-40536, CVE-2025-40551), which allow attackers to load malicious SQLite extensions and achieve remote code execution. https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/ https://github.com/rapid7/metasploit-framework/pull/20917 * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Update rules/windows/initial_access_potential_webhelpdesk_exploit.toml Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>	2026-02-09 09:33:42 -05:00