{"vulnerability": "CVE-2022-3802", "sightings": [{"uuid": "4cf50c3e-bc06-4ea0-89a7-d5d693c99403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2024-04-23T18:10:02.000000Z"}, {"uuid": "1562e20c-47d6-4ee1-9025-22a7abc51dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://infosec.exchange/users/screaminggoat/statuses/113526545474910695", "content": "", "creation_timestamp": "2024-11-22T12:13:31.294382Z"}, {"uuid": "1bd4c99b-8591-4dfa-be9f-2e411ffbbe83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://gist.github.com/tradebot-elastic/0443cfb5016bed103f1940b2f336e45a", "content": "", "creation_timestamp": "2025-01-09T15:31:50.000000Z"}, {"uuid": "ec8384b9-3cf9-4521-b9c0-7a421e7b8660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://gist.github.com/Metis-Intel/b94dbfe682c0d50d18e127d4891208cb", "content": "", "creation_timestamp": "2025-12-16T03:39:35.000000Z"}, {"uuid": "e52cce50-00bd-4e71-807d-03f48fe65c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:53.000000Z"}, {"uuid": "6926a7d6-f30f-4703-b991-33c6304095ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-887b81fb-d3ea0e1ba8258ecc", "content": "", "creation_timestamp": "2025-06-01T02:57:47.388528Z"}, {"uuid": "540ee802-5bca-4890-989b-10f369760e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://gist.github.com/szymongluchnet/f66c882b6a5d077c0404bb5af7dc209d", "content": "", "creation_timestamp": "2025-08-28T14:29:15.000000Z"}, {"uuid": "cfc499f6-edfd-4e72-9fb7-e9e5315596ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38020", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/7176", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-38020\n\ud83d\udd25 CVSS Score: 7.3 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)\n\ud83d\udd39 Description: Visual Studio Code Elevation of Privilege Vulnerability\n\ud83d\udccf Published: 2022-09-13T18:42:23\n\ud83d\udccf Modified: 2025-03-11T16:10:48.516Z\n\ud83d\udd17 References:\n1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38020", "creation_timestamp": "2025-03-11T16:40:30.000000Z"}, {"uuid": "b3da5450-8368-4900-a2b4-a68006bd1c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-38028", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/261e7b79-245a-4093-b5ce-f834cfcb9c57", "content": "", "creation_timestamp": "2026-02-02T12:26:37.948151Z"}, {"uuid": "a0eebf2b-bf66-44dc-82c1-20ca29c21f25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://t.me/malwareanalysisinua/150", "content": "APT28 \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u043e\u0432\u0443\u0454 \u0432\u0440\u0430\u0437\u043b\u0438\u0432\u0456\u0441\u0442\u044c Windows Print Spooler \u0434\u043b\u044f \u043f\u0456\u0434\u0432\u0438\u0449\u0435\u043d\u043d\u044f \u043f\u0440\u0438\u0432\u0456\u043b\u0435\u0457\u0432 \u0437\u0430 \u0434\u043e\u043f\u043e\u043c\u043e\u0433\u043e\u044e \u0440\u0430\u043d\u0456\u0448\u0435 \u043d\u0435\u0432\u0456\u0434\u043e\u043c\u043e\u0433\u043e \u0456\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0443 GooseEgg \n\nMicrosoft \u043f\u043e\u043f\u0435\u0440\u0435\u0434\u0436\u0430\u0454, \u0449\u043e \u0440\u043e\u0441\u0456\u0439\u0441\u044c\u043a\u0430 \u0433\u0440\u0443\u043f\u0430 #APT28 (\u0413\u0420\u0423 \u0432/\u0447 26165) \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u043e\u0432\u0443\u0454 \u0432\u0440\u0430\u0437\u043b\u0438\u0432\u0456\u0441\u0442\u044c Windows Print Spooler \u0434\u043b\u044f \u043f\u0456\u0434\u0432\u0438\u0449\u0435\u043d\u043d\u044f \u043f\u0440\u0438\u0432\u0456\u043b\u0435\u0457\u0432 \u0456 \u0432\u0438\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044f \u043e\u0431\u043b\u0456\u043a\u043e\u0432\u0438\u0445 \u0434\u0430\u043d\u0438\u0445 \u0437\u0430 \u0434\u043e\u043f\u043e\u043c\u043e\u0433\u043e\u044e \u0440\u0430\u043d\u0456\u0448\u0435 \u043d\u0435\u0432\u0456\u0434\u043e\u043c\u043e\u0433\u043e \u0456\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0443 \u0437\u043b\u043e\u043c\u0443 \u043f\u0456\u0434 \u043d\u0430\u0437\u0432\u043e\u044e GooseEgg [1].\nAPT28 \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u043e\u0432\u0443\u0454 \u0446\u0435\u0439 \u0456\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u0430\u043d\u043d\u044f \u0432\u0440\u0430\u0437\u043b\u0438\u0432\u043e\u0441\u0442\u0456 CVE-2022-38028 \u00ab\u043f\u0440\u0438\u043d\u0430\u0439\u043c\u043d\u0456 \u0437 \u0447\u0435\u0440\u0432\u043d\u044f 2020 \u0440\u043e\u043a\u0443 \u0456, \u043c\u043e\u0436\u043b\u0438\u0432\u043e, \u0432\u0436\u0435 \u0437 \u043a\u0432\u0456\u0442\u043d\u044f 2019 \u0440\u043e\u043a\u0443\u00bb. \u041f\u0430\u0442\u0447 \u0432\u0456\u0434 Microsoft \u0432\u0438\u0439\u0448\u043e\u0432 \u043b\u0438\u0448\u0435 \u0432 \u0436\u043e\u0432\u0442\u043d\u0456 2022. \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0456\u044f \u041c\u0430\u0439\u043a\u0440\u043e\u0441\u043e\u0444\u0442 \u043f\u043e\u043c\u0456\u0442\u0438\u043b\u0430, \u0449\u043e Forest Blizzard (APT28) \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u043e\u0432\u0443\u0454 GooseEgg \u044f\u043a \u0447\u0430\u0441\u0442\u0438\u043d\u0443 \u0434\u0456\u044f\u043b\u044c\u043d\u043e\u0441\u0442\u0456 \u043f\u0440\u043e\u0442\u0438 \u0443\u043a\u0440\u0430\u0457\u043d\u0441\u044c\u043a\u0438\u0445, \u0437\u0430\u0445\u0456\u0434\u043d\u043e\u0454\u0432\u0440\u043e\u043f\u0435\u0439\u0441\u044c\u043a\u0438\u0445 \u0456 \u043f\u0456\u0432\u043d\u0456\u0447\u043d\u043e\u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u044c\u043a\u0438\u0445 \u0443\u0440\u044f\u0434\u043e\u0432\u0438\u0445, \u043d\u0435\u0443\u0440\u044f\u0434\u043e\u0432\u0438\u0445, \u043e\u0441\u0432\u0456\u0442\u043d\u0456\u0445 \u0456 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0456\u0437\u0430\u0446\u0456\u0439.\n\n\u0414\u043e \u0440\u0435\u0447\u0456, \u0446\u0435 \u043d\u0435 \u043f\u0435\u0440\u0448\u0430 \u0435\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0456\u044f \u0432\u0440\u0430\u0437\u043b\u0438\u0432\u043e\u0441\u0442\u0456 \u0432 \u0446\u0456\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0456\u0439 \u0441\u043b\u0443\u0436\u0431\u0456 \u0434\u0435\u0440\u0436\u0430\u0432\u043d\u0438\u043c\u0438 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438. \u0423 2010 Stuxnet (NSA) \u0434\u043b\u044f \u0441\u0432\u043e\u0433\u043e \u043f\u043e\u0448\u0438\u0440\u0435\u043d\u043d\u044f \u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0456\u0439 SCADA \u043c\u0435\u0440\u0435\u0436\u0456, \u044f\u043a\u0430 \u043a\u0435\u0440\u0443\u0432\u0430\u043b\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c \u0437\u0431\u0430\u0433\u0430\u0447\u0435\u043d\u043d\u044f \u0443\u0440\u0430\u043d\u0443 \u043d\u0430 \u0444\u0430\u0431\u0440\u0438\u0446\u0456 \u0432 \u0406\u0440\u0430\u043d\u0456, \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u0430\u0432 0-day \u0432\u0440\u0430\u0437\u043b\u0438\u0432\u0456\u0441\u0442\u044c \u0443 Print Spooler Service Impersonation Vulnerability (CVE-2010-2729).\n\n\u0414\u0435\u0442\u0430\u043b\u0456 \u0437\u0430 \u043f\u043e\u0441\u0438\u043b\u0430\u043d\u043d\u044f\u043c [1]:\nhttps://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/", "creation_timestamp": "2024-04-28T12:21:10.000000Z"}, {"uuid": "eed4834d-fe72-4daf-b288-4403e5a2da8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/cibsecurity/52734", "content": "\u203c CVE-2022-38023 \u203c\n\nNetlogon RPC Elevation of Privilege Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-10T00:36:32.000000Z"}, {"uuid": "4cb2e70a-bd79-45a1-bbcb-49c9f90a2168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/OpenHackChile/1676", "content": "Multiple high-severity vulnerabilities [CVE-2022-38023, CVE-2022-37966, CVE-2022-37967, CVE-2022-45141] have been discovered in Samba software that could potentially allow hackers to gain control of the affected systems.\n\nRead: https://thehackernews.com/2022/12/samba-issues-security-updates-to-patch.html", "creation_timestamp": "2022-12-17T16:43:00.000000Z"}, {"uuid": "c8116c64-f9c4-4b48-aeae-e89911f4a2ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/216235", "content": "https://ift.tt/AxjyO8K\nAnalyzing Forest Blizzard\u2019s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials", "creation_timestamp": "2024-04-25T04:51:47.000000Z"}, {"uuid": "596072f2-3aef-4e5c-b300-da6b7bd1b94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "seen", "source": "https://t.me/ctinow/216074", "content": "https://ift.tt/ieb0YTP\nRussian hackers\u2019 custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028)", "creation_timestamp": "2024-04-23T17:26:56.000000Z"}, {"uuid": "3d6f488e-990c-4c96-8d20-9d708b5d2c35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/ics_cert/678", "content": "\u0633\u0627\u0645\u0628\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u0648\u0641\u0642\u06cc\u062a\u200c\u0622\u0645\u06cc\u0632\u060c \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u06a9\u0646\u062a\u0631\u0644 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0631\u0627 \u062f\u0631 \u062f\u0633\u062a \u0628\u06af\u06cc\u0631\u062f.\n\n\u0633\u0627\u0645\u0628\u0627 \u06cc\u06a9 \u0627\u062c\u0631\u0627\u06cc \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u06cc \u0627\u0632 \u067e\u0631\u0648\u062a\u06a9\u0644 \u0634\u0628\u06a9\u0647 SMB \u0627\u0633\u062a \u06a9\u0647 \u062e\u062f\u0645\u0627\u062a \u0641\u0627\u06cc\u0644 \u0648 \u0686\u0627\u067e \u0631\u0627 \u0628\u0631\u0627\u06cc \u06a9\u0644\u0627\u06cc\u0646\u062a \u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u06cc\u0646\u062f\u0648\u0632 \u067e\u06cc\u0627\u062f\u0647 \u0633\u0627\u0632\u06cc \u0645\u06cc \u06a9\u0646\u062f \u0648 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0628\u0627 \u062f\u0627\u0645\u0646\u0647 \u0633\u0631\u0648\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0646\u0646\u062f\u0647 \u062f\u0627\u0645\u0646\u0647 (DC) \u0627\u062f\u063a\u0627\u0645 \u0634\u0648\u062f.\n\n\u0627\u06cc\u0646 \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631 \u0628\u0631 \u0631\u0648\u06cc \u0627\u06a9\u062b\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647 \u06cc\u0648\u0646\u06cc\u06a9\u0633 \u0645\u0627\u0646\u0646\u062f \u0644\u06cc\u0646\u0648\u06a9\u0633\u060c \u0633\u0648\u0644\u0627\u0631\u06cc\u0633\u060c AIX \u0648 BSD\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 Apple macOS Server \u0648 macOS client (Mac OS X 10.2 \u0648 \u0628\u0627\u0644\u0627\u062a\u0631) \u0627\u062c\u0631\u0627 \u0645\u06cc \u0634\u0648\u062f.\n\n\u0646\u0633\u062e\u0647 \u0647\u0627\u06cc \u062c\u062f\u06cc\u062f 4.17.4\u060c 4.16.8 \u0648 4.15.13 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627\u06cc \u062c\u062f\u06cc \u0631\u062f\u06cc\u0627\u0628\u06cc \u0634\u062f\u0647 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 CVE-2022-38023\u060c CVE-2022-37966\u060c CVE-2022-37967 \u0648 CVE-2022-45141 \u0631\u0627 \u0628\u0631\u0637\u0631\u0641 \u0645\u06cc \u06a9\u0646\u0646\u062f.\n\n\u0645\u0634\u06a9\u0644\u0627\u062a \u0628\u0647 \u0634\u0631\u062d \u0632\u06cc\u0631 \u0627\u0633\u062a:\n- CVE-2022-38023 (\u0627\u0645\u062a\u06cc\u0627\u0632 CVSS: 8.1) - \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0646\u0648\u0639 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0636\u0639\u06cc\u0641 RC4-HMAC Kerberos \u062f\u0631 \u06a9\u0627\u0646\u0627\u0644 \u0627\u0645\u0646 NetLogon.\n- CVE-2022-37966 (\u0627\u0645\u062a\u06cc\u0627\u0632 CVSS: 8.1) - \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632 \u062f\u0631 Windows Kerberos RC4-HMAC.\n- CVE-2022-37967 (\u0627\u0645\u062a\u06cc\u0627\u0632 CVSS: 7.2) - \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632 \u062f\u0631 Windows Kerberos.\n- CVE-2022-45141 (\u0627\u0645\u062a\u06cc\u0627\u0632 CVSS: 8.1) - \u0627\u0632 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc RC4-HMAC \u0647\u0646\u06af\u0627\u0645 \u0635\u062f\u0648\u0631 \u0628\u0644\u06cc\u0637 Kerberos \u062f\u0631 \u06a9\u0646\u062a\u0631\u0644\u0631 \u062f\u0627\u0645\u0646\u0647 \u0641\u0639\u0627\u0644 Samba \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Heimdal \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.\n\n\u062f\u0631 \u0647\u0645\u0627\u0646 \u0632\u0645\u0627\u0646\u060c CVE-2022-37966 \u0648 CVE-2022-37967\u060c \u06a9\u0647 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc \u062f\u0647\u062f \u062a\u0627 \u062d\u0642\u0648\u0642 \u0633\u0631\u067e\u0631\u0633\u062a \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0622\u0648\u0631\u062f\u060c \u0628\u0631\u0627\u06cc \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062a\u0648\u0633\u0637 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0628\u062e\u0634\u06cc \u0627\u0632 PatchTuesday \u0646\u0648\u0627\u0645\u0628\u0631 \u0627\u0641\u0634\u0627 \u0634\u062f.\n\n\u0628\u0647 \u0637\u0648\u0631 \u06a9\u0644\u06cc\u060c \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0628\u062f\u0648\u0646 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062d\u0645\u0644\u0647\u200c\u0627\u06cc \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u067e\u0631\u0648\u062a\u06a9\u0644 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u062f\u0631 RFC 4757 (\u0646\u0648\u0639 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc Kerberos RC4-HMAC-MD5) \u0648 MS-PAC (\u0645\u0634\u062e\u0635\u0627\u062a \u0633\u0627\u062e\u062a\u0627\u0631 \u062f\u0627\u062f\u0647 \u06af\u0648\u0627\u0647\u06cc \u0648\u06cc\u0698\u06af\u06cc \u0648\u06cc\u0698\u06af\u06cc) \u0628\u0631\u0627\u06cc \u062f\u0648\u0631 \u0632\u062f\u0646 \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2022-12-23T11:03:27.000000Z"}, {"uuid": "50159801-7341-4cec-9980-10f8c941d41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/ctinow/104492", "content": "Microsoft Netlogon: Potential Upcoming Impacts of CVE-2022-38023, (Sat, Apr 8th)\n\nhttps://ift.tt/i0MpAS6", "creation_timestamp": "2023-04-08T08:41:18.000000Z"}, {"uuid": "35026e4b-ff64-4783-bb21-a79a20531699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/true_secator/3843", "content": "Samba \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u041f\u041e \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438.\n\nSamba - \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMB, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u044b \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043f\u0435\u0447\u0430\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 Microsoft Windows, \u043c\u043e\u0436\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u0434\u043e\u043c\u0435\u043d\u043e\u043c Microsoft Windows Server \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 (DC).\n\n\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 Unix-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Linux, Solaris, AIX \u0438 BSD, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Apple macOS Server \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 macOS (Mac OS X 10.2 \u0438 \u0432\u044b\u0448\u0435).\n\n\u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 4.17.4, 4.16.8 \u0438 4.15.13 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u043a\u0430\u043a\u00a0CVE-2022-38023, CVE-2022-37966, CVE-2022-37967 \u0438 CVE-2022-45141.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a:\n- CVE-2022-38023\u00a0(\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,1) \u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043b\u0430\u0431\u043e\u0433\u043e \u0442\u0438\u043f\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f RC4-HMAC Kerberos \u0432\u00a0\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u043c \u043a\u0430\u043d\u0430\u043b\u0435 NetLogon;\n- CVE-2022-37966\u00a0(\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,1) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows Kerberos RC4-HMAC;\n- CVE-2022-37967\u00a0(\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,2) \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows Kerberos;\n- CVE-2022-45141\u00a0(\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 8,1) \u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f RC4-HMAC \u043f\u0440\u0438 \u0432\u044b\u0434\u0430\u0447\u0435 \u0431\u0438\u043b\u0435\u0442\u043e\u0432 Kerberos \u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 \u0434\u043e\u043c\u0435\u043d\u0430 Samba Active Directory \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Heimdal.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c CVE-2022-37966 \u0438 CVE-2022-37967, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430, \u0431\u044b\u043b\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b Microsoft \u0432 \u0440\u0430\u043c\u043a\u0430\u0445\u00a0\u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e PatchTuesday.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u0436\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0432 RFC 4757 (\u0442\u0438\u043f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f Kerberos RC4-HMAC-MD5) \u0438 MS-PAC (\u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439) \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0440\u0435\u0434\u0435 Windows AD.", "creation_timestamp": "2022-12-19T09:18:25.000000Z"}, {"uuid": "81018eff-3864-4492-bf85-6ef98e4a7246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "exploited", "source": "https://t.me/ctinow/215987", "content": "https://ift.tt/Xg8NrAm\nRussia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw", "creation_timestamp": "2024-04-22T23:31:43.000000Z"}, {"uuid": "df03c88c-6789-423f-82d9-402096e6f855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38026", "type": "seen", "source": "https://t.me/cibsecurity/51142", "content": "\u203c CVE-2022-38026 \u203c\n\nWindows DHCP Client Information Disclosure Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-11T22:26:03.000000Z"}, {"uuid": "f902179e-cf29-4dd0-9fe8-b07f35345e66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3802", "type": "seen", "source": "https://t.me/cibsecurity/52397", "content": "\u203c CVE-2022-3802 \u203c\n\nA vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212638 is the identifier assigned to this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-01T19:13:57.000000Z"}, {"uuid": "35dc421d-38af-4fb0-959c-6924f1602cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38020", "type": "seen", "source": "https://t.me/cibsecurity/49701", "content": "\u203c CVE-2022-38020 \u203c\n\nVisual Studio Code Elevation of Privilege Vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-13T22:31:43.000000Z"}, {"uuid": "449fddb3-e850-40e3-b7e8-ebb135170d93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "published-proof-of-concept", "source": "https://t.me/vxunderground/4320", "content": "We've updated the vx-underground Malware Analysis paper collection\n\n- 2024-01-24 - Layers of Deception: Analyzing the Complex Stages of XLoader 4.3 Malware Evolution\n\n- 2024-02-19 - Pelmeni Wrapper: New Wrapper of Kazuar (Turla Backdoor)\n\n- 2024-03-26 - Comprehensive Analysis of EMOTET Malware: Part 1\n\n- 2024-04-13 - Analysis of malicious Microsoft office macros\n\n- 2024-04-22 - Analyzing Forest Blizzard\u2019s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials\n\n- 2024-04-29 - How to unpack Death Ransomware\n\n- 2024-05-01 - \u201cDirty stream\u201d attack: Discovering and mitigating a common vulnerability pattern in Android apps\n\n- 2024-05-08 - APT28 campaign targeting Polish government institutions", "creation_timestamp": "2024-06-07T15:28:26.000000Z"}, {"uuid": "c2f1596f-9b91-44e7-8e16-d155cc6e06a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/thehackernews/2882", "content": "Multiple high-severity vulnerabilities [CVE-2022-38023, CVE-2022-37966, CVE-2022-37967, CVE-2022-45141] have been discovered in Samba software that could potentially allow hackers to gain control of the affected systems.\n\nRead: https://thehackernews.com/2022/12/samba-issues-security-updates-to-patch.html", "creation_timestamp": "2022-12-17T07:59:17.000000Z"}, {"uuid": "80bc7f78-8caa-48ff-908f-731ab9052b95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "exploited", "source": "https://t.me/xakep_ru/15735", "content": "Microsoft: ATP28 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0431\u0430\u0433 \u0432 Windows Print Spooler \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 APT28 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-38028 \u0432 Windows Print Spooler \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 GooseEgg. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0438 \u00ab\u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 \u0441 \u0438\u044e\u043d\u044f 2020 \u0433\u043e\u0434\u0430, \u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0434\u0430\u0436\u0435 \u0441 \u0430\u043f\u0440\u0435\u043b\u044f 2019 \u0433\u043e\u0434\u0430\u00bb, \u0445\u043e\u0442\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0446\u0435 2022 \u0433\u043e\u0434\u0430.\n\nhttps://xakep.ru/2024/04/24/atp28-gooseegg/", "creation_timestamp": "2024-04-24T12:45:06.000000Z"}, {"uuid": "3bc57eb4-2623-4232-8cb3-f6834d34e20a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38028", "type": "published-proof-of-concept", "source": "https://t.me/club31337/1899", "content": "https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/", "creation_timestamp": "2024-11-11T01:56:53.000000Z"}, {"uuid": "1837d4a1-5f65-4588-9dab-6eb57d0b6c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38023", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/8096", "content": "#Blue_Team_Techniques\n1. How to manage the Netlogon protocol changes related to CVE-2022-38023\nhttps://support.microsoft.com/en-us/topic/kb5021130-how-to-manage-the-netlogon-protocol-changes-related-to-cve-2022-38023-46ea3067-3989-4d40-963c-680fd9e8ee25\n2. xdr33 Backdoor Analysis\nhttps://blog.netlab.360.com/headsup_xdr33_variant_of_ciahive_emeerges", "creation_timestamp": "2023-04-11T11:00:24.000000Z"}]}