Article
Collections
Cyber Labs
-
01
Mounted Guest EDR Bypass
The Mounted Guest EDR Bypass is a tactic used in cyber attacks to evade Endpoint Detection and Response (EDR) protections. This method involves removing EDR program files from a defenseless guest system on a hypervisor, enabling the deployment of ransomware without detection.
-
02
Optimizing Your Cyber Resilience Strategy Through CISO and CRO Connectivity
Combining forces between the Chief Information Security Officer and the Chief Risk Officer may better prepare your business for cyber challenges and provide a comprehensive insight into the exposures of the business.
-
03
Bypassing EDR through Retrosigned Drivers and System Time Manipulation
The Retrosigned Driver EDR Bypass is a novel modification of a technique employed by multiple ransomware groups to bypass EDR and limit visibility into malicious actions by abusing expired code signing certificates to load malicious kernel drivers.
-
04
DNSForge – Responding with Force
Introducing DNSForge, a novel attacker tactic for responding to name resolution requests made to the authoritative DNS server in an internal network landscape, achieving interception and reuse of system credentials without user interaction.
-
05
Unveiling "sedexp": A Stealthy Linux Malware Exploiting udev Rules
Stroz Friedberg identified a stealthy malware, dubbed “sedexp,” utilizing Linux udev rules to achieve persistence and evade detection. This advanced threat, active since 2022, hides in plain sight while providing attackers with reverse shell capabilities and advanced concealment tactics.
-
06
Command Injection and Path Traversal in StoneFly Storage Concentrator
CVE-2024-30213, CVE-2024-31947: Blind Operating System Command Injection and Path Traversal in StoneFly Storage Concentrator
-
07
Adopt an AI Approach with Confidence, for CISOs and CIOs
This article provides an AI adoption approach for technology leaders chartered with the potentially risky decision. We provide an overview of strategic approaches for consideration, beyond mere technological implementation.
-
08
Responding to the CrowdStrike Outage: Implications for Cyber and Technology Professionals
This client alert provides an overview of the current global IT outage that is related to a CrowdStrike update. We provide an overview of CrowdStrike's response and guidance, and Aon Cyber Solutions' recommendations for affected clients.
-
09
DUALITY Part II - Initial Access and Tradecraft Improvements
This blog post discusses tradecraft improvements and how the same pipeline can be used for initial access.
-
10
Cracking Into Password Requirements
This blog post discusses new hashcat rule sets designed to crack passwords with minimum length and character class constraints, resulting in improved performance.
-
11
DUALITY: Advanced Red Team Persistence through Self-Reinfecting DLL Backdoors for Unyielding Control
This blog post introduces the concept of DUALITY, which is a methodology and pipeline for backdooring multiple DLLs on the fly so they are able to re-infect each other if infections are lost due to program updates.
-
12
Restricted Admin Mode – Circumventing MFA On RDP Logons
This blog post demonstrates the use of Restricted Admin mode to circumvent MFA in RDP as a red team tactic.
-
13
Detecting “Effluence”, An Unauthenticated Confluence Web Shell
Discovering Effluence, a unique web shell accessible on every page of an infected Confluence
-
14
Flash Loan Attacks: A Case Study
This blog post explains how flash loans work, their history, and their role in smart contract attacks. We then explore the first major flash loan attack, discuss current threats, and offer security best practices to prevent them.
-
15
Financially Motivated Criminal Group Targets Telecom, Technology & Manufacturing
This client advisory provides an overview of techniques and tactics attributed to a financially motivated criminal group that is actively targeting organizations across various industries.
-
16
New Burp Suite Extension: BlazorTrafficProcessor
Pentesting web applications that use Blazor server comes with unique challenges, especially without tooling. In this post, we discuss why such challenges exist and provide a Burp Suite Extension to address them.
-
17
Command Injection and Buffer Overflow in Multiple Sharp NEC Displays
CVE-2021-20698, CVE-2021-20699: Command Injection and Buffer Overflow vulnerabilities in Sharp NEC Display Solutions UN/UX Series displays.
-
18
Command Injection in Multiple Snap One Araknis Networks Products
CVE-2021-40144, CVE-2021-40844, CVE-2021-42661: Command Injection vulnerabilities in Snap One Araknis Networks® switches and access points.
-
19
Introducing D-Modem: A software SIP modem
Connect to dialup modems over VoIP using SIP, no modem hardware required.
-
20
CVE-2021-1825: Inadequate Input Encoding in WebKit
In August 2020, Aon discovered and reported to Apple an issue relating to the encoding of Uniform Resource Locator (URL) characters in the Safari web browser, making it easier for an attacker to perform Cross-Site Scripting (XSS) attacks.
