Key Points CrowdStrike has observed instances internally and in the field in which the content of one or more channel files on disk is all zeroes. This has been observed in the context of a channel file being written to disk shortly before a machine crashes. The file containing zero content observed after a reboot is an artifact of the way in which the Windows operating system … [Read more...] about Tech Analysis: Channel File May Contain Null Bytes
analysis
May 2024 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 61 vulnerabilities in its May 2024 Patch Tuesday rollout. There are two zero-day vulnerabilities patched, affecting Windows MSHTML (CVE-2024-30040) and Desktop Window Manager (DWM) Core Library (CVE-2024-30051), and one Critical vulnerability patched affecting Microsoft SharePoint Server (CVE-2024-30044). May 2024 Risk Analysis This … [Read more...] about May 2024 Patch Tuesday: Updates and Analysis
Bitcoin Forensic Analysis Uncovers Money Laundering Clusters and Criminal Proceeds
May 01, 2024NewsroomFinancial Crime / Forensic Analysis A forensic analysis of a graph dataset containing transactions on the Bitcoin blockchain has revealed clusters associated with illicit activity and money laundering, including detecting criminal proceeds sent to a crypto exchange and previously unknown wallets belonging to a Russian darknet market. The findings come from … [Read more...] about Bitcoin Forensic Analysis Uncovers Money Laundering Clusters and Criminal Proceeds
April 2024 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 150 vulnerabilities in its April 2024 Patch Tuesday rollout, a much larger amount than in recent months. There are three Critical remote code execution vulnerabilities (CVE-2024-21322, CVE-2024-21323 and CVE-2024-29053), all of which are related to Microsoft Defender for IoT, Microsoft’s security platform for IoT devices. April 2024 … [Read more...] about April 2024 Patch Tuesday: Updates and Analysis
March 2024 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 60 vulnerabilities in its March 2024 Patch Tuesday rollout. There are two Critical vulnerabilities patched (CVE-2024-21407 and CVE-2024-21408), both of which affect the Hyper-V hypervisor. March 2024 Risk Analysis This month’s leading risk type is elevation of privilege (40%) followed by remote code execution (30%) and a tie between … [Read more...] about March 2024 Patch Tuesday: Updates and Analysis
February 2024 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 73 vulnerabilities for its February 2024 Patch Tuesday rollout. These include two actively exploited zero-days (CVE-2024-21412 and CVE-2024-21351), both of which are security feature bypass flaws. Five of the vulnerabilities addressed today are rated Critical while the remaining 68 are rated Important or Moderate. February 2024 Risk … [Read more...] about February 2024 Patch Tuesday: Updates and Analysis
SystemBC Malware’s C2 Server Analysis Exposes Payload Delivery Tricks
Jan 25, 2024NewsroomRemote Access Trojan Cybersecurity researchers have shed light on the command-and-control (C2) server of a known malware family called SystemBC. "SystemBC can be purchased on underground marketplaces and is supplied in an archive containing the implant, a command-and-control (C2) server, and a web administration portal written in PHP," Kroll said in an … [Read more...] about SystemBC Malware’s C2 Server Analysis Exposes Payload Delivery Tricks
Elastic Stack AIOps Labs 8.12: GA of log rate analysis
It’s been a huge team effort to bring this tool to life and finally to general availability. Several features available in Elasticsearch®’s search analytics engine were essential to make this possible:The p_value scoring heuristic for significant terms aggregation enables the identification of statistically significant field/value pairs within logs. This aggregation facilitates … [Read more...] about Elastic Stack AIOps Labs 8.12: GA of log rate analysis
November Patch Tuesday 2023: Updates and Analysis
Microsoft has released security updates for 58 vulnerabilities, including five zero-days, three of which are being actively exploited. One of the zero-days (CVE-2023-36025) is a Windows SmartScreen Security Feature Bypass Vulnerability, the second (CVE-2023-36033) is a privilege escalation vulnerability in the Windows DWM Core Library, and the third (CVE-2023-36036) is another … [Read more...] about November Patch Tuesday 2023: Updates and Analysis
October 2023 Patch Tuesday: Updates and Analysis
This month marks the 20th anniversary of Patch Tuesday, and Microsoft has released security updates for 104 vulnerabilities, including three zero-days. One of the zero-days (CVE-2023-41763) is an elevation of privilege vulnerability in Microsoft Skype for Business. The second (CVE-2023-36563) is an information disclosure vulnerability in Microsoft WordPad, and the third … [Read more...] about October 2023 Patch Tuesday: Updates and Analysis