Threat hunts for Zoom
2 hunts covering Zoom, each with a hypothesis, the queries that test it and what the hunt cannot see.
2 hunts
-
high Part 2 of 2Research by Rapid7
Zimbra BEC: Manufactured Reality and Manipulation
An attacker has compromised a Zimbra server and is manipulating organizational trust by configuring unauthorized mail forwarding and initiating outbound connections to meeting platforms to facilitate social engineering.
3 query1 analytic1 checkpoint1 action2 taskCVE-2022-27925 · CVE-2022-37042 -
high Part 1 of 2Research by Rapid7
Exploitation of Zimbra Mail Services
An adversary is exploiting unauthenticated remote code execution vulnerabilities in Zimbra services to execute discovery commands via spawned shells or drop JSP-based webshells for persistence.
3 query1 analytic1 checkpoint1 action2 taskCVE-2022-27925 · CVE-2022-37042