Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*

4 briefs RSS
high advisory

Suspicious Microsoft Office Child Process Activity

Microsoft Office applications are frequently abused to spawn system processes to execute malicious code, download payloads, or facilitate privilege escalation.

Microsoft Office
1r 3t 1c
high advisory

Potential Privileged Escalation via SamAccountName Spoofing (CVE-2021-42278)

This rule detects potential privilege escalation attempts by exploiting CVE-2021-42278, which involves spoofing the samAccountName attribute to impersonate a domain controller and elevate privileges from a standard domain user to a domain administrator by identifying suspicious computer account name rename events where a machine account name is renamed to a user-like account name.

Active Directory privilege-escalation windows active-directory cve-2021-42278
2r 1t 1c
high advisory

Potential Privilege Escalation via InstallerFileTakeOver (CVE-2021-41379)

This rule detects potential exploitation of the InstallerTakeOver vulnerability (CVE-2021-41379), where successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.

Edge privilege-escalation cve-2021-41379 windows
2r 1t 1c
high advisory

Suspicious Rundll32 Execution Without Command-Line Arguments

The execution of rundll32.exe without command-line arguments is detected via endpoint telemetry, a behavior indicative of potential malicious activity such as Cobalt Strike, leading to arbitrary code execution and system compromise.

PoC Windows Print Spooler defense-evasion windows rundll32
2r 1t 1c updated