Tag
Local Privilege Escalation Vulnerability in Windows Kernel (CVE-2024-21338)
2 rules 5 TTPs 7 CVEsCVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.
Potential NetNTLMv1 Downgrade Attack via Registry Modification
2 rules 2 TTPsThis brief details a registry modification attack that downgrades the system to NTLMv1 authentication, enabling NetNTLMv1 downgrade attacks, typically performed with local administrator privileges on Windows systems.
SiYuan Zero-Click NTLM Theft and Blind SSRF via Mermaid Diagrams
2 rules 3 TTPs 1 CVESiYuan is vulnerable to zero-click NTLM hash theft on Windows and blind SSRF on all platforms due to insecure Mermaid.js configuration, where a malicious Mermaid diagram containing a protocol-relative URL can be injected into a note, causing the Electron client to fetch the URL, triggering SMB authentication on Windows and sending the victim's NTLMv2 hash to the attacker. On macOS and Linux, the request acts as a tracking pixel and blind SSRF.
Potential NetNTLMv1 Downgrade Attack via Registry Modification
2 rules 2 TTPsAttackers modify the Windows registry to weaken NTLM authentication, forcing a downgrade to the less secure NTLMv1 protocol, potentially leading to credential compromise.
Detecting Rare SMB Connections for Potential NTLM Credential Theft
2 rules 2 TTPsThis brief details a detection strategy for rare SMB connections originating from internal networks to the internet, potentially indicating NTLM credential theft via rogue UNC path injection.