Agent Tesla | Old RAT Uses New Tricks to Stay on Top
sentinelone.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports99.9%Top 0.03%88.5priority
- CVE-2017-8570Microsoft Office Remote Code Execution VulnerabilityMicrosoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File5 reports89.9%Top 0.21%78.4priority
Where it names them
CVE-2017-11882 Original (opens in a new tab) ↗
Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns.
CVE-2017-8570 Original (opens in a new tab) ↗
Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.