Analyzing Attacker Behavior Post-Exploitation of MS Exchange
rapid7.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2018-18913Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP…1 report0.4%Top 66%10.7priority
Where it names them
CVE-2018-18913 Original (opens in a new tab) ↗
These scripts would then execute encoded PowerShell commands that would retrieve a legitimate version of the Opera Browser that has a known DLL search order vulnerability (CVE-2018-18913).
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.