Vulnerabilitymedium
How a machine-learning model in Kaspersky SIEM detected DLL
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-27076 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 | 14% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 09cd396c8f4b4989a83ed7a1f33f5503 | g E0E092D4EFC15F25FD9C0923C52C33D6 loads SystemSettings.dll 09CD396C8F4B4989A83ED7A1F33F5503 loads policymanager.dll A72036F635CECF0DCB1E9C6F49A8FA5B lo |
| md5 | 831252e7fa9bd6fa174715647ebce516 | ings.dll E83F331BD1EC115524EBFF7043795BBE policymanager.dll 831252E7FA9BD6FA174715647EBCE516 wsc.dll Paths C:\ProgramData\SystemSettings.exe C:\ProgramD |
| md5 | a72036f635cecf0dcb1e9c6f49a8fa5b | ll 09CD396C8F4B4989A83ED7A1F33F5503 loads policymanager.dll A72036F635CECF0DCB1E9C6F49A8FA5B loads wsc.dll Malicious files EA2882B05F8C11A285426F90859F2 |
| md5 | e0e092d4efc15f25fd9c0923c52c33d6 | porate systems. IoC Legitimate files used for DLL hijacking E0E092D4EFC15F25FD9C0923C52C33D6 loads SystemSettings.dll 09CD396C8F4B4989A83ED7A1F33F5503 l |
| md5 | e83f331bd1ec115524ebff7043795bbe | t . exe C : \ Program Files \ Chiniks \ policymanager . dll E83F331BD1EC115524EBFF7043795BBE The SettingSyncHost.exe file is a system host process for s |
| md5 | ea2882b05f8c11a285426f90859f23c6 | 036F635CECF0DCB1E9C6F49A8FA5B loads wsc.dll Malicious files EA2882B05F8C11A285426F90859F23C6 SystemSettings.dll E83F331BD1EC115524EBFF7043795BBE policym |
From the original article
8 min read at securelist.com
Our colleagues from the AI expertise center recently developed a machine-learning model that detects DLL-hijacking attacks. We then integrated this model into the Kaspersky Unified Monitoring and Analysis Platform SIEM system. In a separate article , our colleagues shared how the model had been created and what success they had achieved in lab environments.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.