Rafael brinhosa

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Engine	Contact
360	kefu@360.cn
Abusix	support@abusix.com, https://lookup.abusix.com/
Acronis	virustotal-falsepositive@acronis.com
ADMINUSLabs	info@adminuslabs.net, samples@adminus.net, falsepositive@adminuslabs.net
AegisLab	support@aegislab.com
Ahnlab	e-support@ahnlab.com, samples@ahnlab.com
AILabs (Monitorapp)	aicc@monitorapp.com
Alibaba	virustotal@list.alibaba-inc.com

	#!/bin/bash

	# 🚀 Discover More: Testing Your Firewall in 60 Seconds: A Lightweight WAF Testing Script That Anyone Can Use
	# Learn how this script works and the best practices for WAF testing.
	# Read the full article here:
	# 👉 https://medium.com/@kochuraa/testing-your-firewall-in-60-seconds-a-lightweight-waf-testing-script-that-anyone-can-use-a7a725fefcb7

	# Safe WAF Tester Script
	# Usage: ./waf-smoke-test.sh <URL> [-o output.md] [-H "Header: Value"]
	# Examples:

	from aiohttp import web

	async def index(request):
	return web.Response(text="Hello, World!")

	app = web.Application()
	app.router.add_routes([
	web.static("/static", "static/", follow_symlinks=True),
	])
	app.router.add_get('/', index)

	# Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
	# Author: Oddvar Moe - @oddvar.moe

	$drivers = get-childitem -Path c:\windows\system32\drivers
	$web_client = new-object system.net.webclient
	$jsonString = $web_client.DownloadString("https://www.loldrivers.io/api/drivers.json")
	$jsonString = $jsonString -replace '"INIT"','"init"'
	$loldrivers = $jsonString \| ConvertFrom-Json

	Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)

	#################################################################
	# reconFTW config file #
	#################################################################

	# General values
	tools=~/Tools # Path installed tools
	SCRIPTPATH="$( cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )" # Get current script's path
	profile_shell=".$(basename $(echo $SHELL))rc" # Get current shell profile
	reconftw_version=$(git rev-parse --abbrev-ref HEAD)-$(git describe --tags) # Fetch current reconftw version
	generate_resolvers=false # Generate custom resolvers with dnsvalidator

	import openai
	import boto3
	import json
	import time
	from typing import Dict, List

	openai.api_key = '### SET YOUR OPENAPI API KEY HERE ###'
	session = boto3.session.Session()
	client = session.client('iam')

	Windows Registry Editor Version 5.00

	[-HKEY_CLASSES_ROOT\ms-msdt]

	title: Suspicious msdt.exe execution - Office Exploit
	id: 97a80ed7-1f3f-4d05-9ef4-65760e634f6b
	status: experimental
	description: This rule will monitor suspicious arguments passed to the msdt.exe process. These arguments are an indicator of recent Office/Msdt exploitation.
	references:
	- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
	- https://twitter.com/MalwareJake/status/1531019243411623939
	author: 'Matthew Brennan'
	tags:
	- attack.execution