Abstract In this blog I describe a recent intrusion that started with
the exploit of CVE-2020-0688. Microsoft released a patch for this
vulnerability on 11 February 2020. In order for this exploit to work, an
authenticated account is needed to be abl...
RSA Netwitness Endpoint (NWE) offers various ways to alert the analyst
of potentially malicious activity. Typically, we recommend that an
analyst look at the IIOCs daily, and investigate and categorize
(whitelist/graylist/blacklist) any hits on IIOC ...
Hello Jeremy, I wanted to complement some of the replies that Rui has
already provided. The mounting of shares (c$, admin$, and ipc$) is a
typical step of lateral movement. Typically, or at some point, this will
happen from an endpoint in the network...
Hello Toma, If Blocking is not working for you it could be because it is
not enabled. Blocking can be enabled/disabled in three locations:1.
Globally by going to: Configure -> Global Parameters -> Enable Blocking
System checkbox2. At the group level ...
