Investigating a SharePoint Compromise: IR Tales from the Field

Category	Details
Threat Actors	Unnamed attacker exploiting SharePoint CVE-2024-38094.
Campaign Overview	Exploited SharePoint vulnerability (CVE-2024-38094) for initial access; compromised Exchange server account; moved laterally, targeting Active Directory.
Target Regions	Not specified.
Methodology	- Initial access via CVE-2024-38094 (SharePoint). - Disabled security tools (e.g., Windows Defender). - Used Fast Reverse Proxy (FRP) for persistence.
Product Targeted	Microsoft SharePoint, Microsoft Exchange, Active Directory.
Malware Reference	- Mimikatz (renamed to 66.exe). - Certify.exe. - FRP tool (msvrp.exe).
Tools Used	- Impacket. - ADExplorer64.exe. - Kerbrute. - Nxc.exe. - Everything.exe. - Huorong Antivirus (to impair defenses).
Vulnerabilities Exploited	CVE-2024-38094 (SharePoint Remote Code Execution).
TTPs	- Impairing Defenses (T1562). - Exploit Public-Facing Application (T1190). - OS Credential Dumping (T1003). - Use of Scheduled Tasks (T1053).
Attribution	Not explicitly attributed.
Recommendations	- Apply patches for SharePoint (CVE-2024-38094). - Use endpoint monitoring tools (e.g., InsightIDR). - Monitor suspicious commands via logs.
Source	RAPID7

Read full article: https://www.rapid7.com/blog/post/2024/10/30/investigating-a-sharepoint-compromise-ir-tales-from-the-field/

Disclaimer: The above summary has been generated by an AI language model.