Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

8 briefs RSS
high advisory

Microsoft Dataverse Privilege Escalation Vulnerability

A vulnerability in Microsoft Dataverse identified as CVE-2024-38064 allows a remote, unauthenticated attacker to escalate privileges and potentially gain administrative access to the service.

Dataverse privilege-escalation cloud-security vulnerability high-confidence-source
1t 1c
high advisory

Multiple Privilege Escalation Vulnerabilities in Microsoft Authenticator and Xbox Gaming Services

Local attackers can exploit multiple vulnerabilities in Microsoft Authenticator and Xbox Gaming Services to achieve elevated privileges on Windows systems.

Microsoft Authenticator +1 privilege-escalation windows vulnerability
1t 2c
critical threat

Active Exploitation of Windows IKE Extension RCE

CVE-2022-34721 is a critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) extension, which is being actively exploited in the wild to gain unauthorized code execution.

exploited Windows vulnerability remote-code-execution
2t 1c
high advisory

Potential Privileged Escalation via SamAccountName Spoofing (CVE-2021-42278)

This rule detects potential privilege escalation attempts by exploiting CVE-2021-42278, which involves spoofing the samAccountName attribute to impersonate a domain controller and elevate privileges from a standard domain user to a domain administrator by identifying suspicious computer account name rename events where a machine account name is renamed to a user-like account name.

Active Directory privilege-escalation windows active-directory cve-2021-42278
2r 1t 1c
high advisory

Potential Privilege Escalation via InstallerFileTakeOver (CVE-2021-41379)

This rule detects potential exploitation of the InstallerTakeOver vulnerability (CVE-2021-41379), where successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.

Edge privilege-escalation cve-2021-41379 windows
2r 1t 1c
critical advisory

Computer Account Changes via Anonymous Logon Detected

Detection of Windows Event 4742 indicating a computer account change performed by an ANONYMOUS LOGON account, which is abnormal and could signify malicious activity, particularly Zerologon exploitation.

PoC Splunk Enterprise +6 zerologon privilege-escalation windows
2r 1t 1c updated
high advisory

Suspicious Rundll32 Execution Without Command-Line Arguments

The execution of rundll32.exe without command-line arguments is detected via endpoint telemetry, a behavior indicative of potential malicious activity such as Cobalt Strike, leading to arbitrary code execution and system compromise.

PoC Windows Print Spooler defense-evasion windows rundll32
2r 1t 1c updated
high advisory

DNS Kerberos Coercion Attempt Detection

This brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.

PoC Fortinet edge appliances +38 kerberos coercion dns cve-2025-33073
3r 3t 4c 4i updated