SA - SOC335-313 - CVE-2024-49138 Exploitation Detected
Автор: InfoSec_Bret
Загружено: 2025-09-06
Просмотров: 172
Continuing with the Security Analyst Path, we tackle an MEDIUM alert for CVE-2024-49138 Exploitation Detected' event. Was this actual exploitation or just a false alarm?
EventID: 313
Event Time: Jan, 22, 2025, 02:37 AM
Rule: SOC335 - CVE-2024-49138 Exploitation Detected
Level: Security Analyst
Hostname: Victor
Ip Address: 172.16.17.207
Process Name: svohost.exe
Process Path: "C:\temp\service_installer\svohost.exe"
Process ID: 7640
Parent Process: C:\Windows\System32\WINDOWSPOWERSHELL\V1.0\powershell.exe
Command Line: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
File Hash: b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9
Process User: EC2AMAZ-ILGVOIN\LetsDefend
Trigger Reason: Unusual or suspicious patterns of behavior linked to the hash have been identified, indicating potential exploitation of CVE-2024-49138.
Device Action: Allowed
Items in question:
https://www.virustotal.com/gui/file/b...
https://viz.greynoise.io/ip/185.107.5...
https://www.abuseipdb.com/check/185.1...
NOTES:
https://www.tarlogic.com/blog/cve-202...
https://security.humanativaspa.it/cve...
https://security.humanativaspa.it/cve...
https://github.com/MrAle98/CVE-2024-4...
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
