09/12/2024 | News release | Distributed by Public on 09/12/2024 03:01
Observed attack techniques (OAT) detected using Vision One:
Please note that in the implementation, NmPoller.exe can execute PowerShell scripts without launching another powershell.exe process. If you can monitor PowerShell scripts with Antimalware Scan Interface (AMSI), verify that all scripts executed by WhatsUp Gold's Active Monitor PowerShell Script function are the ones you expect. To reduce the monitoring effort, it is also a good idea to suspend the use of Active Monitor PowerShell Script function until the latest patch is applied.
Also, because the vulnerability CVE-2024-6670 is described as allowing the compromise of the user account, it is quite possible that attacks would be observed as other events. Considering this, until the latest patch is applied, it is worth tightening access controls to WhatsUp Gold as much as possible and closely monitoring the events of all related processes.
Conclusion
Patch management is still important but always difficult. In this case, the PoC was published several days after the patch was released, and an incident that appeared to be affected by the vulnerability was observed on the same day, just a few hours after published. This observed fact shows that if the vulnerability being fixed is marked as severe, it is strongly encouraged to apply the patch as soon as it is released, even if no PoC is available.
The key to preventing incidents like this are not limited to patch management. There should be several defenses in place in addition patch management. The most common defenses to mitigate risks are access control and multi-factor authentication (MFA), which security teams can apply through best practices like:
Maintaining a daily readiness and vigilance against cyberattacks is essential to ensuring that emergency response is targeted only at things that truly require it. We hope that after reading this article, security teams will once again check that no unintended hosts or services are exposed to the public internet as part of their peacetime preparations. This approach is now known as part of attack surface management.
Organizations can also consider powerful security technologies such as Trend Vision One™, which offers multilayered protection and behavior detection, helping block malicious tools and services before they can inflict damage on user machines and systems.