Secure Cloud Analytics Alerts and Observations Reference Guide
cisco.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports99.4%Top 0.06%83.8priority
- CVE-2025-31324SAP NetWeaver Unrestricted File Upload VulnerabilitySAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1505.003Web Shell+2 more · 1 report99.5%Top 0.06%80.7priority
- CVE-2023-38545This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake78.7%Top 0.41%34.9priority
Where it names them
CVE-2020-1472 Original (opens in a new tab) ↗
FollowmitigationstepsinreferencetoCVE-2020-1472.
CVE-2025-31324 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
65 EmailSpam 66 EmergentProfile 66 EmpireCommandandControl 67 EndpointExfiltrationofAWSCredentials 68 ExcessiveAccessAttempts(External) 68 ExcessiveConnectionstoNetworkPrinters 69 ExecutionofAdFindBinaryforDiscovery 70 ExecutionsofFilefromRecycleBin 70 ExploitationofWebShellthroughCVE-2025-31324
ExploitationofWebShellthroughCVE-2025-31324
ContentDownloadUsingPowershell l DataExfiltrationusingrclone l DCSyncAttackBehavior l DLLFileConnectedtoaRawIPAddress l DownloadofExecutableFilesusingWebDAV l EndpointExfiltrationofAWSCredentials l ExecutionofAdFindBinaryforDiscovery l ExecutionsofFilefromRecycleBin l ExploitationofWebShellthroughCVE-2025-31324
ss l NewActiveDirectoryHiddenUserAccount Added l NTLMRelayExploitationviaInveigh l ResidentialProxyApplicationUtilized l SuspiciousUseofDiscoveryTools 4.9 May29,2025 Addedthefollowingalerts: l AWSPotentialPrivilegeEscalation l CertifyActiveDirectoryCSEnumeration l ExploitationofWebShellthroughCVE-2025- 31324
CVE-2023-38545 Original (opens in a new tab) ↗
indicativeofexploitationofCVE-2023-38545.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.