Patchfirst

Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)

Lab52 / S2 Grupo · 30 May 2019 · github.com · Licence: CC-BY-SA-4.0; sources/annoctr/LICENSE.txt

Read the original ↗

CVEs this report names

4 CVEs
  1. CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
    Microsoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports
    >99.9%Top 0.02%
    89.2priority
  2. CVE-2017-11882Microsoft Office Memory Corruption Vulnerability
    Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports
    99.9%Top 0.03%
    88.5priority
  3. CVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability
    Microsoft · Office and WordPadKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution12 reports
    99.5%Top 0.06%
    88.4priority
  4. CVE-2017-8759Microsoft .NET Framework Remote Code Execution Vulnerability
    Microsoft · .NET FrameworkKEVPublic exploitHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter4 reports
    88.7%Top 0.23%
    77.4priority

Where it names them

CVE-2012-0158
CVE-2012-0158
Original (opens in a new tab) ↗
<http://cve.circl.lu/cve/CVE-2012-0158>
Original (opens in a new tab) ↗
CVE-2017-11882
CVE-2017-11882
Original (opens in a new tab) ↗
<http://cve.circl.lu/cve/CVE-2012-0158> http://cve.circl.lu/cve/CVE-2017-0199 <https://attack.mitre.org/matrices/enterprise/> <http://cve.circl.lu/cve/CVE-2017-8759> <http://cve.circl.lu/cve/CVE-2017-11882>
Original (opens in a new tab) ↗
CVE-2017-0199
CVE-2017-0199
Original (opens in a new tab) ↗
http://cve.circl.lu/cve/CVE-2017-0199
Original (opens in a new tab) ↗
CVE-2017-8759
CVE-2017-8759
Original (opens in a new tab) ↗
<https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html> <http://cve.circl.lu/cve/CVE-2012-0158> http://cve.circl.lu/cve/CVE-2017-0199 <https://attack.mitre.org/matrices/enterprise/> <http://cve.circl.lu/cve/CVE-2017-8759>
Original (opens in a new tab) ↗

Techniques drawn from this report

4 links, in kill-chain order

Execution Exploitation for Client Execution T1203 for CVE-2017-11882

MITRE CTID mapping of the CVE

CVE-2012-0158 CVE-2017-0199 CVE-2017-8759 CVE-2017-11882
Original (opens in a new tab) ↗
CVE-2017-0199 CVE-2017-8759 CVE-2017-11882
Original (opens in a new tab) ↗
CVE-2017-8759 CVE-2017-11882
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2017-8759

MITRE CTID mapping of the CVE

CVE-2012-0158 CVE-2017-0199 CVE-2017-8759
Original (opens in a new tab) ↗
CVE-2017-0199 CVE-2017-8759
Original (opens in a new tab) ↗
CVE-2017-8759
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2012-0158

AI mapping from the description

CVE-2012-0158
Original (opens in a new tab) ↗
CVE-2012-0158 CVE-2017-0199
Original (opens in a new tab) ↗
CVE-2012-0158 CVE-2017-0199 CVE-2017-8759
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2017-0199

AI mapping from the description

CVE-2012-0158 CVE-2017-0199
Original (opens in a new tab) ↗
CVE-2017-0199
Original (opens in a new tab) ↗
CVE-2017-0199 CVE-2017-8759
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close