![SnapAttack](/img/default-banner.jpg)
- Видео 115
- Просмотров 75 215
SnapAttack
США
Добавлен 19 окт 2021
Turning Novel Threats into Detections Easily with SnapAttack
Our CTO, Fred Frey, met with Teddy Powers from Google Cloud Security at the Google Massachusetts Ave Office to discuss the topic: "Turning Novel Threats into Detections Easily with SnapAttack." Discover how SnapAttack can integrate with Mandiant's threat intelligence, security validation, and Google Chronicle to enhance detection and create actionable workflows for your organization.
Просмотров: 88
Видео
Latest APT41 Campaign: Detection Opportunities | ThreatSnapShot
Просмотров 20814 дней назад
Have you ever read a threat report and thought, “These tools could definitely be superhero names”? Well, you’re not alone! In this video, we dive into the recent APT41 campaign and explore the detection opportunities that arise from it. From tools like BlueBeam, AntSword, DustPan, and PineGrove, we break down how these were used in APT41’s latest operations and how you can detect them in your e...
GrimResource: Arbitrary Code Execution via Malicious MSC file | Threat SnapShot
Просмотров 224Месяц назад
Discover how to detect the GrimResource attack, a novel code execution technique leveraging Microsoft Management Console (MMC) files. This threat snapshot video breaks down Elastic Security Labs' research on this stealthy initial access vector that evades common defenses. Key points covered: - Overview of the GrimResource technique and its use of MSC files - Multiple detection strategies, from ...
Microsoft Recall: Detecting Abuse | Threat SnapShot
Просмотров 2342 месяца назад
You've probably heard of Microsoft's new Recall feature by now. It's a info stealer's dream come true. There has been a lot of information release about how this new feature is a security nightmare and how it works. But today we are going to dig in and discover how to actually detect abuse of this new feature. ✅ *Subscribe to SnapAttack for more in-depth analyses and real-world applications of ...
Understanding CVE-2024-32002: Git Remote Code Execution | Threat SnapShot
Просмотров 9902 месяца назад
Welcome to this week's episode of SnapAttack Threat Snapshot! In this video, we'll dive into CVE-2024-32002, a critical remote code execution (RCE) vulnerability in Git that leverages symlink handling in repositories with submodules. This vulnerability can be exploited through a simple git clone command, potentially allowing attackers to execute arbitrary code on the victim's machine. What You'...
Hunting CVE-2024-30051: Desktop Window Manager Privilege Escalation | Threat SnapShot
Просмотров 6812 месяца назад
🔍 In this episode, we dive into CVE-2024-30051, a critical out-of-bounds write vulnerability in the Desktop Window Manager. This bug, similar to CVE-2023-36033, allows attackers to escalate privileges to SYSTEM by exploiting a heap overflow in dwmcore.dll. CVE-2024-30051 has been actively exploited to deploy malware like Qakbot, as identified by Kaspersky. This video covers the process of hunti...
ESXi Ransomware: Trends, Logging, and Detection | Threat SnapShot
Просмотров 8133 месяца назад
Since 2021, ransomware groups have set their sights on VMware ESXi hypervisors, with the SEXi variant, emerging in 2024, being the most recent threat. The Babuk Locker was one of the first to target ESXi, and its leaked source code enabled other strains like ESXiArgs, BlackBasta, and Clop to develop customized variants terminating VMs and encrypting data on ESXi servers. While employing similar...
Operationalizing the 2024 M-Trends Report | Threat SnapShot
Просмотров 1643 месяца назад
Threat reports are invaluable resources, but transforming their insights into actionable defense strategies can be a daunting task. In this week's Threat SnapShot, AJ takes you on a journey through the 2024 M-Trends report, unveiling a seamless path to operationalize its findings using SnapAttack's cutting-edge platform. Whether you're a threat hunter, detection engineer, or security analyst, t...
Hunting the XZ Backdoor (CVE-2024-3094) | Threat SnapShot
Просмотров 4703 месяца назад
Welcome back to another episode of SnapAttack's Threat SnapShot! I’m AJ King, the Director of Threat Research here at SnapAttack. In today’s episode, I dive into detecting the XZ Backdoor, CVE-2024-3094, a sophisticated supply chain attack that could have had a massive impact on many Linux distributions. This episode is crucial for anyone responsible for protecting Linux systems, providing you ...
Hunting Exploitation of SmartScreen and Streaming Service CVEs | Threat SnapShot
Просмотров 2385 месяцев назад
Let's face it - if patch management was a silver bullet then we wouldn't need vulnerability management, and threat actors know this. Vulnerabilities get picked up by threat actors and exploited as 1-days. In this week's Threat SnapShot, we'll look at a few recent Windows vulnerabilities that have been added to the CISA Known Exploited Vulnerability catalog and are actively used by threat actors...
ScreenConnect Compromise: Hackers Are Watching, Are You Ready? | Threat SnapShot
Просмотров 6515 месяцев назад
We know threat actors use RMM tools for command and control and to blend in with other legitimate activity in networks. But how about exploiting RMM tools for fun, profit, and remote code execution? In this week's Threat SnapShot, we'll look at two recent vulnerabilities in ConnectWise ScreenConnect (CVE-2024-1708 and CVE-2024-1709) an authentication bypass and directory traversal that can be c...
Click with Caution: The Moniker Link Vulnerability (CVE-2024-21413) Exposed | Threat Snapshot
Просмотров 1,9 тыс.5 месяцев назад
Click with Caution: The Moniker Link Vulnerability (CVE-2024-21413) Exposed | Threat Snapshot
Untangling Scattered Spider's Web: Hunting for RMM Tools | Threat SnapShot
Просмотров 2666 месяцев назад
Untangling Scattered Spider's Web: Hunting for RMM Tools | Threat SnapShot
Unzipped! The Hidden Dangers Behind .Zip Domains | Threat SnapShot
Просмотров 826 месяцев назад
Unzipped! The Hidden Dangers Behind .Zip Domains | Threat SnapShot
It's Raining Shells! Recent CVEs in SharePoint, Splunk, and Confluence, Oh My! | Threat SnapShot
Просмотров 1466 месяцев назад
It's Raining Shells! Recent CVEs in SharePoint, Splunk, and Confluence, Oh My! | Threat SnapShot
Playing Cat and Mouse with the Attacker: Frequent Item Set Mining in the Registry (CAMLIS 2022)
Просмотров 506 месяцев назад
Playing Cat and Mouse with the Attacker: Frequent Item Set Mining in the Registry (CAMLIS 2022)
Just Windows Things: Recent XAML PrivEsc and WinSXS DLL Search Order Hijacking | Threat SnapShot
Просмотров 1036 месяцев назад
Just Windows Things: Recent XAML PrivEsc and WinSXS DLL Search Order Hijacking | Threat SnapShot
Hunting for Attacks Using Recent Apache Struts and OfBiz Vulnerabilities | Threat SnapShot
Просмотров 1396 месяцев назад
Hunting for Attacks Using Recent Apache Struts and OfBiz Vulnerabilities | Threat SnapShot
Abusing MS Access Linked Tables for NTLM Relay Attacks | Threat SnapShot
Просмотров 1297 месяцев назад
Abusing MS Access Linked Tables for NTLM Relay Attacks | Threat SnapShot
Streamline SIEM Migrations and Optimize Your SOC with SnapAttack and Google Cloud
Просмотров 1977 месяцев назад
Streamline SIEM Migrations and Optimize Your SOC with SnapAttack and Google Cloud
Turning Intelligence into Action: Scaling the Pyramid of Pain with MATI + SnapAttack | mWISE 2023
Просмотров 878 месяцев назад
Turning Intelligence into Action: Scaling the Pyramid of Pain with MATI SnapAttack | mWISE 2023
Continuous Validation: Trusting Your Detections Even When They Don’t Fire | SnapAttack at mWISE 2023
Просмотров 1058 месяцев назад
Continuous Validation: Trusting Your Detections Even When They Don’t Fire | SnapAttack at mWISE 2023
SmartScreen Bypass with Malicious Links (CVE-2023-36025) | Threat SnapShot
Просмотров 8908 месяцев назад
SmartScreen Bypass with Malicious Links (CVE-2023-36025) | Threat SnapShot
Analyzing a Cerber Ransomware Attack via Confluence RCE Exploit (CVE-2023-22518) | Threat SnapShot
Просмотров 2208 месяцев назад
Analyzing a Cerber Ransomware Attack via Confluence RCE Exploit (CVE-2023-22518) | Threat SnapShot
Detecting Apache ActiveMQ Exploitation Activity (CVE-2023-46604) | Threat SnapShot
Просмотров 4578 месяцев назад
Detecting Apache ActiveMQ Exploitation Activity (CVE-2023-46604) | Threat SnapShot
Prioritize, Mobilize, Validate, and Enhance Threat Detection: SnapAttack Interview with TAG Cyber
Просмотров 1168 месяцев назад
Prioritize, Mobilize, Validate, and Enhance Threat Detection: SnapAttack Interview with TAG Cyber
Hunting for Confluence (CVE-2023-22515) and Looney Tunables (CVE-2023-4911) | Threat SnapShot
Просмотров 2529 месяцев назад
Hunting for Confluence (CVE-2023-22515) and Looney Tunables (CVE-2023-4911) | Threat SnapShot
Hunting for TeamCity CI/CD (CVE-2023-42793) and Cisco IOS (CVE-2023-20198) | Threat SnapShot
Просмотров 4559 месяцев назад
Hunting for TeamCity CI/CD (CVE-2023-42793) and Cisco IOS (CVE-2023-20198) | Threat SnapShot
Adversary's Arsenal - T1053 - Scheduled Tasks
Просмотров 3089 месяцев назад
Adversary's Arsenal - T1053 - Scheduled Tasks
Detecting Malicious MinIO Updates and PPLBlade LSASS Dumping | Threat SnapShot
Просмотров 28510 месяцев назад
Detecting Malicious MinIO Updates and PPLBlade LSASS Dumping | Threat SnapShot
That diagram helped me with a CTF, thx
Htb compiled? Lol
@@texastitan6567 Hahaaaaaaa, how did you know?
@@rustyshackleford1379 haha cause it helped me too lmao!
Hey you can helpe? I have many doubts about these machine
@@adibnayafabdala have you got a foothold/user yet?
Bravo mostang panda
This is great information thanks. Do you have any information about the new Outlook threat. earlier this week
How to remove Mustangpanda.a from USB. Drive.?
Oh this is interesting
Thanks for uploading this kind awesome video,keep uploading we need this kind of videO Thanks
Check your mic settings. The audio is about a 3 where the commercials are 7 out of 10. Subscribed.
Thanks for the feedback! I will play around with my mic settings to try and fix this.
The stages involved in resolving problems related to CVE-2023-34362 include: 1. Detection: Identify the presence of the vulnerability in the system, in this case, the remote code execution vulnerability in MOVEit Transfer. 2. Patching: Apply the necessary security updates provided by the vendor, in this case, Progress, to address the vulnerability and prevent exploitation. 3. Mitigation: Implement additional security measures or configurations to reduce the risk of exploitation while waiting for the patch to be applied. 4. Monitoring: Continuously monitor the system for any signs of exploitation or unusual activities to ensure the vulnerability is effectively addressed. 5. Communication: Inform relevant stakeholders within the organization about the vulnerability, its impact, and the actions being taken to mitigate the risk. By following these stages, organizations can effectively resolve problems related to CVE-2023-34362 and enhance the security of their systems.
The stages involved in decoding CVE-2023-34362 include verification, assignment of a CVE ID, description creation, vetting process, and potential modification. Problems with this process can be addressed by ensuring accurate verification, thorough description, proper vetting, and timely reanalysis for any modifications.
this cve i think not work in this time ?
How can I subscribe ??
thanks SnapAttack !
Sorry self promotion BUG BOUNTY POC ruclips.net/video/17zlPTSz7B8/видео.html
How to get Event ID 25 Outlook?
great stuff, always a pleasure to watch :-)
Great Walkthrough 👏👏👏
nice! Good tool SnapAttack Enterprise Edition is. great content and tool creators on your platform as well!
Can you share the exploit code?
Awesome videos - wealth of knowledge on all of your content - thanks for everything !
the info on CVE-2023-42793 is not showing on the community edition? And I can't see how to even look at what it would cost to subscribe and be able to use and contribute to ongoing attacks?
Thanks for posting!
Do you have a community addition of SnapAttack?
I really liked this demo I'm going to subscribe keep pumping out the content
Shared on my Truth Social Account
cool video
Great narrative, nice vid 🤙
These ads are even on RUclips 💀
How was the initial shell established. The diagram showed step 1 as running ssh commands from the beginning. What was step zero that got me a shell in the first place?? That said, I'm unclear what the compromise is, because if I'm starting with shell to begin with, then it doesn't matter the language of the tool I use for persistence. Anyway, I was trying to follow along closely, but I didn't see the initial compromise to the linux router. What vendor of router are we even talking about? What CVE should we be concerned with. Lots of missing information, although I enjoy the direction you're heading in.
Au = Australia
Wish I found this channel sooner. Thanks for the heads up. Exfil in azure/office 365 is becoming all too common
You are doing really great, you are a hidden gem that people are not aware of. I am glad I found you.
How do i get rid of it
feels like 2005 sql injection? haha
Hi,what is the version number of CALDERA demonstrated in your video? There seems to be some correlation between YAML execution and caldera version numbers.
Great video!
amongus.
This channel is really underrated.
next up, NK apt's posing as chinese steel company's Hr personnel. people act like they dont give a shit lol they will when that shit hits the 'fan'
Hey is there a way to get your Microsoft account back from a hacker because my account got hacked and I can do anything 😢😢😢😢
Just stumbled upon this channel, great video keep up the work.
nice video but can you please zoom the terminal font please
It take a long while till they(Russians ) are down. Just ask myself if they don't have anything similar in the wild now.
Great video Tim. Those Russian snakes are really slippery.
Thanks!
Underrated channel
Thank you! We hope to help everyone better understand threats and identify hunt/detection opportunities!
How does queuejumper actually work 😢 everyone says its trivial but how to perform it pls make a video on it.
I'm in need of an eml file reader/editor that isn't buggy right now. If anyone knows of one. Friend of mine has a stalker and I can't help them block the person's access as it was crafted eml files that when read get added to a compile pipeline on the devices in question. I need a native eml reader with a strong sandbox but one I can redact sensitive user's info in before sharing them, for their privacy. This is a pretty big problem and the hackers will likely see this, I currently can't even use my pc's (all busted by the hacks) for analysis, and discontinuing use of this account tomorrow because it may be compromised. But will be back to check on this comment.💤
Only 97 vulns? Thanks Tim
this is a great representation of WHAT this thing is ....well done! NOW ....how the hell do you get rid of it ?????!!!!!
Thanks for your video, you should do another one continuing on from what you do with the DC machine hash to compromise the domain. Cheers
Interesting, thank you