ATT&CK® Matrix V14

Our Security Operations Centre has a full view of all events on clients' networks, our Ai enabled Siem, linked to Realtime Threat Intelligence TI feeds from sources such as CISA ensures we are ahead of the Cyber curve, how does your Cyber Security compare and how quick are they to implement new advisories Indicators of compromise (IOC), mapping to ATT&CK Matrix

Our system updates every day, keeping ahead of evolving threats.

For companies that want have the latest protection, 24 hour by 7 Ai enabled with human oversight from real people based in Scotland and supported by the power of Seceon inc.

Tactic TA0006 Credential Access
How do you monitor and detect credential access?.

Mitre defines this as: Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

17 are the number of techniques within this tactic, how do you monitor all of these in realtime, detect and remediate?.

T11110 Brute Force defined as Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

How often does an adversary attempt to gain access by attacking your systems, firewall for example or vpn or any system.

Owen Anderson
IP Clarity is pleased to announce availability of Flow

Voiceflex Flow in partnership with Telavox is the all new cloud telephony and collaberation system in the cloud, powered by Telavox of Sweden and delivered by UK provider Voiceflex and now sold thru partner IP Clarity. Contact us now to discuss how your business can benefit from Flow

Owen Anderson
Sonicwall Security Blog - Log4 RCE

Sonicwall blog post on Apache Log4 remote code execution vulnerability

Overview:

Apache Log4j is a Java-based logging utility that can be configured through a configuration file or through Java code. Apache Log4j provides many features, such as reliability, extensibility, multiple configuration support including xml/json/yaml, excellent performance and more.

Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI-related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. Here is an example of the attack code:

Workarounds and protections:

To mitigate the issue, in previous releases (>2.10) this behavior can be mitigated by setting system property “log4j2.formatMsgNoLookups” to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting “com.sun.jndi.rmi.object.trustURLCodebase” and “com.sun.jndi.cosnaming.object.trustURLCodebase” to “false”.

SonicWall Capture Labs Threat Research is aware of vulnerability in Log4j Java-based logging library and has released the following IPS signature to detect the exploitation of threats related to CVE-2021-44228:  

  • 2307 Apache Log4j2 JNDI Log Messages Remote Code Execution

  • 18198  Apache Log4j2 JNDI Log Messages Remote Code Execution LDAPS

  • 18199  Apache Log4j2 JNDI Log Messages Remote Code Execution NIS

  • 18200  Apache Log4j2 JNDI Log Messages Remote Code Execution NDS

  • 18201  Apache Log4j2 JNDI Log Messages Remote Code Execution COBRA

  • 18202  Apache Log4j2 JNDI Log Messages Remote Code Execution RMI

  • 18203  Apache Log4j2 JNDI Log Messages Remote Code Execution IIOP

  • 18204  Apache Log4j2 JNDI Log Messages Remote Code Execution DNS 2

  • 2311  Apache Log4j2 JNDI Log Messages Remote Code Execution HTTP

  • 2315  Apache Log4j2 JNDI Log Messages Remote Code Execution DNS

  • 2328  Apache Log4j2 JNDI Log Messages Remote Code Execution HTTPS

SonicWall Capture Labs Threat has also released the following WAF signature to protect their customer:

  • 1116 Apache Log4j2 JNDI Log Messages Remote Code Execution

Many attacks have been observed for the past 4 day

Please note that if your web service/server is accessible over HTTPS, then enabling of Server DPI-SSL is necessary for the above signature to detect exploits targeting this vulnerability.

Owen Anderson
Microsoft Guidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation
Owen Anderson