https://feed.craftedsignal.io/vendors/rapid7/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 04 May 2026 09:14:11 +0000https://feed.craftedsignal.io/briefs/2026-05-velociraptor-vulns/Mon, 04 May 2026 09:14:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-velociraptor-vulns/Multiple vulnerabilities in Rapid7 Velociraptor could allow an attacker to disclose information or cause a denial of service.Multiple vulnerabilities have been identified in Rapid7 Velociraptor. An attacker could potentially exploit these vulnerabilities to achieve information disclosure or to trigger a denial-of-service (DoS) condition. While specific CVEs or technical details are not provided in the advisory, the potential impact necessitates proactive monitoring and mitigation strategies to prevent exploitation. This issue was reported on 2026-05-04. Defenders should monitor for unusual activity related to Velociraptor instances, particularly activity indicative of unauthorized data access or resource exhaustion.

Attack Chain

1. The attacker identifies a vulnerable instance of Rapid7 Velociraptor.
2. The attacker crafts a malicious request targeting one of the undisclosed vulnerabilities.
3. The vulnerable Velociraptor instance processes the malicious request.
4. For information disclosure, the system exposes sensitive data such as configuration details, user information, or internal system data, accessible to the attacker.
5. For Denial of Service, the vulnerable component consumes excessive resources (CPU, memory, network bandwidth).
6. Legitimate user requests to Velociraptor are delayed or fail due to resource exhaustion.
7. The attacker repeats the malicious request to sustain the Denial of Service condition.

Impact

Successful exploitation of these vulnerabilities could lead to unauthorized disclosure of sensitive information managed by Rapid7 Velociraptor. A denial-of-service attack could disrupt monitoring operations and prevent legitimate users from accessing or utilizing the Velociraptor platform, impacting incident response capabilities. The number of affected instances and specific sectors are currently unknown.

Recommendation

• Monitor network traffic to Velociraptor instances for suspicious patterns and anomalies indicative of exploitation attempts (network_connection).
• Implement rate limiting and input validation mechanisms on Velociraptor endpoints to mitigate potential DoS attacks and information disclosure vulnerabilities (webserver).
• Monitor Velociraptor logs for error messages or unusual activity patterns that may indicate exploitation attempts (file_event).

]]>mediumadvisoryvulnerabilitydenial-of-serviceinformation-disclosurehttps://feed.craftedsignal.io/briefs/2024-01-03-kerberoasting-unusual-process/Wed, 03 Jan 2024 14:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-kerberoasting-unusual-process/Detects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.This detection identifies unusual processes initiating network connections to the standard Kerberos port (88) on Windows systems. Typically, the lsass.exe process handles Kerberos traffic on domain-joined hosts. The rule aims to detect processes other than lsass.exe communicating with the Kerberos port, which could indicate malicious activity such as Kerberoasting (T1558.003) or Pass-the-Ticket (T1550.003). The detection is designed to work with data from Elastic Defend and SentinelOne Cloud Funnel. This can help security teams identify potential credential access attempts and lateral movement within the network.

Attack Chain

1. An attacker compromises a user account or system within the domain.
2. The attacker executes a malicious binary or script (e.g., PowerShell) on the compromised system.
3. The malicious process attempts to request Kerberos service tickets (TGS) for various services within the domain. This is done by connecting to the Kerberos port (88) on a domain controller.
4. The attacker uses tools like Rubeus or Kerberoast.ps1 to enumerate and request TGS tickets.
5. The unusual process (not lsass.exe) sends Kerberos traffic to the domain controller.
6. The attacker extracts the Kerberos tickets from memory or network traffic.
7. The attacker cracks the offline TGS tickets to obtain service account passwords (Kerberoasting).
8. The attacker uses the compromised service account credentials to move laterally within the network or access sensitive data.

Impact

A successful Kerberoasting or Pass-the-Ticket attack can lead to unauthorized access to sensitive resources and lateral movement within the network. Attackers can compromise service accounts with elevated privileges, potentially leading to domain-wide compromise. Detection of this behavior can prevent attackers from gaining access to critical assets. While the exact number of victims and sectors targeted are unknown, this technique is widely used by various threat actors in targeted attacks.

Recommendation

• Deploy the “Kerberos Traffic from Unusual Process” Sigma rule to your SIEM and tune for your environment. Enable network connection logging to capture the necessary traffic.
• Investigate any alerts triggered by the Sigma rule, focusing on the process execution chain and potential malicious binaries.
• Review event ID 4769 for suspicious ticket requests as mentioned in the rule’s documentation.
• Examine host services for suspicious entries as outlined in the original Elastic detection rule using Osquery.
• Monitor for processes connecting to port 88, filtering out legitimate Kerberos clients like lsass.exe, using the “Detect Kerberos Traffic from Non-Standard Process” Sigma rule.
• Investigate processes identified by the rule and compare them to the list of legitimate processes to identify unauthorized connections to the Kerberos port.

]]>mediumthreatkerberoastingcredential-accesslateral-movementwindows