THE THREAT (Executive Summary):
On December 8th, FireEye disclosed that they were the victim of a nation-state attack. During their investigation, they discovered that an attacker targeted and accessed certain Red Team assessment tools FireEye used to test their customers’ security. These tools mimic the behavior of known cyber threat actors and fortunately, this disclosure did not include tools to exploit zero-day vulnerabilities or unknown techniques.
FireEye has developed and publicly released approximately 300 countermeasures, aimed at arming the security community at large to defend against the attacks they authored. eSentire has implemented new detection content based on information shared by FireEye. We will continue to monitor the situation and deploy new detection content as necessary.
What we’re doing about it:
- Additional esNETWORK rules have been deployed to identify tools executing against customer environments to supplement existing detection coverage
- esENDPOINT file hashes are being periodically queried and checked against Indicators of Compromise provided by FireEye
- esLOG and esENDPOINT rules are being evaluated for new and refined detection opportunities
- MVS customers – Coverage is provided for 15 of 16 CVEs identified by FireEye. Coverage for CVE-2019-8394 will be available in short order.
- eSentire will be conducting a live webinar on this topic on Thursday December 17th at 11am ET.
What you should do about it:
- Ensure anti-virus signatures are up to date
- MVS customers should review scan reports for the presence of vulnerable systems. These reports can be reviewed by accessing the latest vulnerability reports on the eSentire Insight Portal. MVS Cloud customers can also access reports by accessing their Tenable.io instance or eSentire Insight Portal. Non-MVS customers should review vulnerability scan reports for the presence of vulnerable systems.
- Ensure systems are fully up-to-date to mitigate against known exploits
Additional Information:
Prioritized CVEs by FireEye:
CVE-2019-11510 - Pulse Secure SSL VPNs
CVE-2020-1472 - Microsoft Active Directory
CVE-2018-13379 - Fortinet Fortigate SSL VPN
CVE-2018-15961 - Adobe ColdFusion
CVE-2019-0604 - Microsoft SharePoint
CVE-2019-0708 - Windows Remote Desktop Services
CVE-2019-11580 - Atlassian Crowd
CVE-2019-19781 - Citrix Application Delivery Controller and Citrix Gateway
CVE-2020-10189 - ZoHo ManageEngine Desktop Central
CVE-2014-1812 - Windows
CVE-2019-3398 - Confluence
CVE-2020-0688 - Microsoft Exchange
CVE-2016-0167 - Microsoft Windows
CVE-2017-11774 - Microsoft Outlook
CVE-2018-8581 - Microsoft Exchange Server
CVE-2019-8394 - ZoHo ManageEngine ServiceDesk Plus
