Rex Guo – Medium

Published in Confluera Engineering

·Dec 3, 2021

Reflective Code Loading in Linux — A New Defense Evasion Technique in MITRE ATT&CK v10

Summary This blog discusses a Linux reflective code loading technique newly added in the MITRE ATT&CK framework v10 update. Our research team contributed this technique to the MITRE ATT&CK organizers to help improve the industry standard. Reflective code loading allows threat actors to execute file-based malware without touching the disk! We…

4 min read

Reflective Code Loading in Linux — A New Defense Evasion Technique in MITRE ATT&CK v10

Published in Confluera Engineering

·Dec 3, 2021

Detection and Response for Linux Reflective Code Loading Malware— This is How

Summary In part 1 of this blog series, we discussed how reflective code loading using anonymous files works in Linux. In this blog, We will dive deeper into how to detect and respond to such behavior. We will also discuss legitimate usage of the anonymous file. This blog is co-authored…

Cybersecurity

5 min read

Detection and Response for Linux Reflective Code Loading Malware— This is How

Published in Confluera Engineering

·Sep 22, 2021

Detection and Response to OMIGOD Exploitations — Azure OMI Vulnerabilities

Background Recently, a few vulnerabilities in Azure (named: OMIGOD) were discovered by Wiz’s research team: CVE-2021–38647 — Unauthenticated RCE as root (Severity: 9.8) CVE-2021–38648 — Privilege Escalation vulnerability (Severity: 7.8) CVE-2021–38645 — Privilege Escalation vulnerability (Severity: 7.8) CVE-2021–38649 — Privilege Escalation vulnerability (Severity: 7.0) These vulnerabilities exist in the ubiquitous software…

Cloud Security

4 min read

Detection and Response to OMIGOD Exploitations — Azure OMI Vulnerabilities

Published in Confluera Engineering

·Jun 22, 2021

Threat Detections for Container Lateral Movements and Container Escapes — This is How

Introduction The simplicity and flexibility of microservice architecture has led to an increasing adoption of containers and kubernetes in the cloud. According to Gartner, more than 75% of global organizations will be running containerized apps in production by 2022. As the adoption increases, threat actors are evolving their toolsets to compromise…

Cybersecurity

4 min read

Threat Detections for Container Lateral Movements and Container Escapes — This is How

Published in Confluera Engineering

·Feb 2, 2021

The Sudo vulnerability may be 10 years old, but your detection and response should be cutting edge

A heap overflow vulnerability in sudo was recently discovered (CVE-2021-3156, named: Baron Samedit). By exploiting this vulnerability, any unprivileged user can use the default sudo configuration to obtain root privileges (no password required) on the vulnerable host. Interestingly, the sudo privilege escalation vulnerability remained undiscovered for nearly ten years. It…

Sudo

6 min read