Hunting Exploitation of SmartScreen and Streaming Service CVEs | Threat SnapShot

Let's face it - if patch management was a silver bullet then we wouldn't need vulnerability management, and threat actors know this. Vulnerabilities get picked up by threat actors and exploited as 1-days. In this week's Threat SnapShot, we'll look at a few recent Windows vulnerabilities that have been added to the CISA Known Exploited Vulnerability catalog and are actively used by threat actors like Water Hydra and Raspberry Robin. The first, a SmartScreen bypass (CVE-2023-36025 and CVE-2024-21412), allows code execution through crafted short links. The second, a privilege escalation vulnerability in the Windows Streaming Service driver (CVE-2023-29360), allows attackers to gain SYSTEM level privileges on a compromised host. We'll dig into these threats and discuss detection and threat hunting strategies to keep you protected.
References:
- thehackernews....
- www.trendmicro...
- www.bleepingco...
- big5-sec.githu...
SnapAttack Resources:
- app.snapattack... - Collection: Water Hydra Exploits Microsoft Defender SmartScreen Zero-Day | Threat SnapShot
- app.snapattack... - Threat: CVE-2023-36025 - Smartscreen Bypass
- app.snapattack... - Threat: CVE-2024-21412 SmartScreen Bypass
- app.snapattack... - Detection: Possible CVE-2023-36025 Exploitation
- app.snapattack... - Detection: Suspicious URL File
- app.snapattack... - Detection: Suspicious WebDav HTTP Request
- app.snapattack... - Detection: Suspicious File Execution From Internet Hosted WebDav Share
- app.snapattack... - Detection: Windows WebDAV User Agent
- app.snapattack... - Detection: Suspicious WebDav Client Execution Via Rundll32.EXE
- app.snapattack... - Collection: Microsoft Streaming Service Elevation of Privilege (CVE-2023-29360) | Threat SnapShot
- app.snapattack... - Threat: CVE-2023-29360 Windows Streaming Service Privilege Escalation
- app.snapattack... - Detection: Elevated System Shell Spawned
- app.snapattack... - Detection: Possible Winlogon Process Injection
- app.snapattack... - Detection: Win32 OpenProcess API Call With PROCESS_ALL_ACCESS Rights
- app.snapattack... - Detection: Possible Windows Streaming Service Driver Exploitation
- app.snapattack... - Detection: Windows Drivers Loaded by Signature

[@FahimKhalid-ov9wi]

this cve i think not work in this time ?