Patchfirst

McAfee Defender’s Blog: NetWalker

mcafee.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

Read the original ↗

CVEs this report names

4 CVEs
  1. CVE-2020-0796Microsoft SMBv3 Remote Code Execution Vulnerability
    Microsoft · SMBv3KEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application3 reports
    99.8%Top 0.04%
    87.7priority
  2. CVE-2017-0213Microsoft Windows Privilege Escalation Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.3T1548Abuse Elevation Control MechanismT1068Exploitation for Privilege Escalation4 reports
    84.3%Top 0.3%
    87.0priority
  3. CVE-2015-1701Microsoft Win32k Privilege Escalation Vulnerability
    Microsoft · Win32kKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation3 reports
    55.9%Top 0.95%
    86.0priority
  4. CVE-2019-1458Microsoft Win32k Privilege Escalation Vulnerability
    Microsoft · Win32kKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation2 reports
    74.4%Top 0.51%
    84.5priority

Where it names them

CVE-2020-0796
Exploitation for Privilege Exploitation ((T1068) CVE-2020-0796
Original (opens in a new tab) ↗
Network Security Platform (CVE-2020-0796)
Original (opens in a new tab) ↗
CVE-2017-0213
Exploitation for Privilege Exploitation ((T1068) CVE-2017-0213
Original (opens in a new tab) ↗
Network Security Platform (CVE-2017-0213); Endpoint Security Platform 10.7 (CVE-2017-0213) Threat Prevention, Application Control (MAC)
Original (opens in a new tab) ↗
CVE-2015-1701
Exploitation for Privilege Exploitation ((T1068) CVE-2015-1701
Original (opens in a new tab) ↗
Network Security Platform (CVE-2015-1701); Endpoint Security Platform 10.7, Threat Prevention, Application Control (MAC)
Original (opens in a new tab) ↗
CVE-2019-1458
Exploitation for Privilege Exploitation ((T1068) CVE-2019-1458
Original (opens in a new tab) ↗
Network Security Platform (CVE-2019-1458); Endpoint Security Platform 10.7 (CVE-2019-1458) Threat Prevention, Application Control (MAC)
Original (opens in a new tab) ↗

Techniques drawn from this report

4 links, in kill-chain order

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2017-0213

MITRE CTID mapping of the CVE

Exploitation for Privilege Exploitation ((T1068) CVE-2017-0213
Original (opens in a new tab) ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2015-1701

MITRE CTID mapping of the CVE

Exploitation for Privilege Exploitation ((T1068) CVE-2015-1701
Original (opens in a new tab) ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2019-1458

AI mapping from the description

Exploitation for Privilege Exploitation ((T1068) CVE-2019-1458
Original (opens in a new tab) ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2020-0796

ATT&CK ID cited in the report

Exploitation for Privilege Exploitation ((T1068) CVE-2020-0796
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close