Forest Global Training Partners

Cyber Risks · Cisco Talos

Life Cycle and Detection of an Exploit Kit

Summary: Cisco Talos published a presentation explaining how exploit kits work, aimed at readers with no prior knowledge, and noted that the success of the Cool Exploit Kit has let its author buy vulnerabilities. Talos also said 200 of the 222 rules in its new Exploit-Kit category are enabled in the balanced policy by default, and that organizations not running a current SEU are missing detection.

Bottom line: Exploit kits remain one of the more prevalent ways of dropping malware on end-users, and the Cool Exploit Kit's ability to fund vulnerability purchases points toward more 0-days for defenders to handle. If your Snort deployment is not on a current SEU, 22 of the 222 Exploit-Kit rules are not in the default balanced policy at all.

Read the original at Cisco Talos ↗

Topics
Malware
Related