2022OverWatchThreatHuntingReport
go.crowdstrike.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reports>99.9%Top 0.01%89.4priority
- CVE-2021-34523Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports>99.9%Top 0.01%89.3priority
- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitMedium · 6.6T1548.002Bypass User Account ControlT1565Data Manipulation9 reports99.8%Top 0.04%87.6priority
Where it names them
CVE-2021-34473 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
(CVE-2021-34473,8 CVE-2021-345239 and CVE-2021-3120710) are
https:/ /msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473.
CVE-2021-34523 Original (opens in a new tab) ↗
https:/ /msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523.
CVE-2021-31207 Original (opens in a new tab) ↗
https:/ /msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.