Patchfirst

BRONZE UNION Cyberespionage Persists Despite Disclosures

sophos.com · Undated · Licence: not assessed; coordinator-only cache; do not redistribute

Read the original ↗

CVEs this report names

1 CVE
  1. CVE-2014-6324Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability
    Microsoft · Kerberos Key Distribution Center (KDC)KEVPublic exploitHigh · 8.8T1078Valid AccountsT1558Steal or Forge Kerberos Tickets1 report
    87.3%Top 0.25%
    73.0priority

Where it names them

CVE-2014-6324
w64.log >ppp.log2016-10-03T09:30:10 PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication
Original (opens in a new tab) ↗

Techniques drawn from this report

1 link, in kill-chain order

Credential Access Exploitation for Credential Access T1212 for CVE-2014-6324

Matched in report text

w64.log >ppp.log2016-10-03T09:30:10 PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close