Skip to content
Threat Feed
Subscribe

Tag

Remote-Execution

4 briefs RSS
high advisory

FreeRDP Denial of Service via Smartcard Cache Request

A null pointer dereference vulnerability in FreeRDP prior to 3.29.0 allows remote attackers to trigger a crash in the client process via crafted smartcard cache requests.

FreeRDP +1 denial-of-service vulnerability remote-execution
2t 6c
medium advisory

Suspicious WSMAN Provider Image Loads

A detection engineering rule targets suspicious loading of Windows Management (WSMAN) provider DLLs by unusual processes, indicating potential local or remote execution and lateral movement through Windows Remote Management (WinRM) by threat actors.

lateral-movement remote-execution windows-management winrm
1r 2t
medium advisory

Incoming Execution via WinRM Remote Shell

This rule detects incoming execution via Windows Remote Management (WinRM) remote shell on a target host, which could be an indication of lateral movement by monitoring network traffic on ports 5985 or 5986 and processes initiated by WinRM.

Elastic Defend +1 lateral-movement windows winrm remote-execution
2r 1t
high advisory

Suspicious Remote Process Instantiation via WMI

Detection of wmic.exe execution with parameters indicative of spawning a process on a remote system, a technique often used for lateral movement and remote code execution.

Windows wmi lateral-movement remote-execution
2r 1t