admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_theme_command_execution.yml

Browse Source
This commit is contained in:
Gowthamaraj rajendran
2023-10-01 11:24:18 -07:00
parent 7ac5bba3df
commit f7c411cfa2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_theme_command_execution.yml
+1 -1
View File
@@ -7,7 +7,7 @@ status: experimental
type: TTP
description: 'The vulnerability, referred to as "ThemeBleed", is a high-severity issue with a score of 8.8. It allows remote attackers to execute code if the target user opens a malicious .THEME file crafted by the attacker.
The exploit takes advantage of a race condition when handling .MSSTYLES files. Specifically, when a version number "999" is used, there's a discrepancy between the time a DLL’s (“_vrf.dll”) signature is verified and when the library loads.
This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.''
This allows an attacker to replace a verified DLL with a malicious one, leading to arbitrary code execution.'
data_source:
- Sysmon
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)