Tag
Threat Intelligence
Threat Advisory: PwnKit – Local Privilege Escalation Vulnerability in Major Linux Distributions
Updated: 01/26/2022 17:54 Severity: HIGH Background A vulnerability was discovered in Polkit pkexec, a SUID-root program that is included on every major Linux distribution by default. This vulnerability enables local privilege escalation to root on the victim host. Proof-of-concepts (PoCs) have been published for this vulnerability but ‘in-the-wild’ exploitation has not yet been observed. Affected […]
An Update on the ReliaQuest Response to the Log4j2 Vulnerability
Updated 12/29 A zero-day vulnerability involving the Log4j 2 utility was publicly disclosed on December 9, 2021, via the Apache GitHub. Log4j 2 is an open-source Java logging library integrated in many enterprise applications, as well as open-source software and other services. The widespread use and configuration variables make this is a high impact threat. ReliaQuest has […]
Mitigate Threats on the Endpoint with ReliaQuest + SentinelOne
ReliaQuest delivers a force multiplier for security operations to increase visibility, decrease complexity and reduce risks. Watch this demo video to follow an investigation leveraging both GreyMatter and the power of the SentinelOne API to mitigate potential threats on the endpoint. In this example, the Sentinel One and GreyMatter integration provides unified visibility and automatically […]
Mitigate Phishing + Boost Security Operations with ReliaQuest
Minimize the time it takes to mitigate phishing attacks and force multiply your security operations with ReliaQuest GreyMatter Open XDR-as-a-Service. Many organizations continue to face phishing threats and have limited visibility to quickly address them. Watch this demo video to learn how ReliaQuest GreyMatter can increase visibility, decrease complexity and reduce risks driving better outcomes […]
Threat Research Report: Ransomware Advisory
Ransomware has become one of the most popular and destructive attacks in cyber security in recent years. Instead of stealing data as in most other attacks, the goal of ransomware is to hold the user’s data hostage by making it unusable until a ransom fee is paid. This is accomplished by encrypting the victim’s machine […]
Threat Research Report: Hafnium Exchange Zero-Days
On March 2, 2021, Microsoft Security Response Center released updates related to vulnerabilities affecting on-premises deployments of Microsoft Exchange Server 2013/2016/2019. Microsoft also revealed details around active exploitation of these vulnerabilities using zero-day exploits. This RQ Threat Advisory outlines the vulnerability and its exploitation in more detail including IoCs (indicators of compromise) and GreyMatter detection […]
ReliaQuest GreyMatter
ReliaQuest GreyMatter is a SaaS-based, unified threat detection, investigation and response platform that integrates and improves an enterprise’s on-premises and multi-cloud technologies. GreyMatter saves security teams valuable time and increases effectiveness by enabling automatic and continuous threat detection, threat hunting, and remediation. More than 250 Global 2000 enterprises rely on ReliaQuest.
Detect Solorigate and SUNBURST Attacker Techniques with the MITRE ATT&CK Framework—We’ll Get You Started
As folks are continuing to work to address the Solorigate/ SUNBURST compromise, our team has been mapping the tactics and techniques used by the attackers to the MITRE ATT&CK framework, and building detection content to deploy for our customers. If you haven’t already, please read this blog first to get the basics. What follows is […]
Solorigate, SUNBURST aka FireEye and SolarWinds Compromise – Recommended Actions to Limit Your Exposure
Threat Advisory On December 13th, a disclosure was made for a compromise in the SolarWinds IT Management software suite code base that made a supply chain attack possible for all SolarWinds customers. Attackers implanted backdoors in legitimate, signed DLL files contained in update packages for SolarWinds Orion in March and June of 2020 that were then used to breach customers who upgraded to the affected versions (versions 2019.4 HF 5 […]
No results
