Hi guys, Welcome to the Advanced Video Search Engine, and you are watching CVEs in Windows Event Logs? What You Need to Know. That video is uploaded by 13Cubed at 2020-01-20T05:29:17-08:00. We are promoting this video only for entertainment and educational purpose only. So, I hope you like & enjoy it. [ebmW42YYveI]
| Name | CVEs in Windows Event Logs? What You Need to Know |
| Video Uploader | Video From 13Cubed |
| Upload Date | This Video Uploaded At 20-01-2020 13:29:17 |
| Video Discription | In January of 2020, Microsoft patched an NSA-reported critical vulnerability within the Windows CryptoAPI. There are plenty of resources that explain the technical details of the attack, labeled CVE-2020-0601, or “Chain of Fools/CurveBall.” However, another extremely important change involves the fact that Microsoft is now logging attempted exploitation of this CVE within the Windows Application Event Log. This has numerous positive implications for defenders. Watch this episode to learn everything you need to know. ⚠️ Update: It appears Windows 10 Version 1903 only generates events for spoofed certificates associated with binaries, not websites. More testing is required to validate these results. SANS Webcast: Microsoft Patch Tuesday crypt32.dll Vulnerability Overview: https://www.sans.org/webcasts/microsoft-patch-tuesday-crypt32dll-vulnerability-overview-113060 CveEventWrite Function: https://docs.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-cveeventwrite CVE-2020-0601 | Windows CryptoAPI Spoofing Vulnerability: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 CVE-2020-0601: The ChainOfFools/Curveball Attack Explained with POC: https://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc/ Windows Event Log - Audit-CVE (Splunk Searches): https://nullsec.us/windows-event-log-audit-cve/ *** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. *** Background Music Courtesy of Anders Enger Jensen: https://www.youtube.com/user/HariboOSX #Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics ebmW42YYveI |
| Category | Science & Technology |
| Tags | forensics | digital forensics | DFIR | CVE 2020-0601 | CVE-2020-0601 | CVE 2020-0601 POC | CVE-2020-0601 POC | Chain of Fools | ChainOfFools | ChainOfFools attack | ChainOfFools vulnerability | ChainOfFools exploit | CurveBall attack | CurveBall vulnerability | CurveBall exploit | crypt32.dll | crypt32 | CryptoAPI | Crypto API | CveEventWrite | Audit CVE | Audit-CVE | Microsoft-Windows-Audit-CVE | Event ID 1 | Possible detection of CVE | Elliptic Curve vulnerability | ECC vulnerability | NSA vulnerability |
