Grey Noise | Creation and utilization of Grey Noise tags
Summary: GreyNoise's research team builds tags, described in its documentation as a signature-based detection method for capturing patterns and creating data subsets, using two approaches: data-driven, which works backward from sensor data through discovery, research, and implementation phases, and emerging threats-driven, which monitors sources including tech news, social media, and CISA's Known Exploited Vulnerabilities Catalog. The emerging threats method produced early warning for mass scanning or exploitation of CVE-2022-26134, an Atlassian Confluence Server RCE, and running signatures across historical data let GreyNoise determine first-occurrence dates and show that OMIGOD was exploited before exploit details were publicly available.
What's compelling: GreyNoise's historical replay of signatures showed OMIGOD was exploited before its exploit details were public - meaning the window between real-world exploitation and your patch decision can already be closed by the time you hear about the vulnerability.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-26134
- Related
- CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 02, 2022