New Tags
CVE-2009-0545, CVE-2019-12725, CVE-2020-29390
Tag: Zeroshell RCE Attempt [Intention: Malicious]
- This IP address has been observed attempting to exploit a remote command execution vulnerability in Zeroshell.
- Sources: NIST [1, 2, 3]
- See it on GreyNoise Viz
Tag: Cisco Smart Install RCE Attempt [Intention: Malicious]
- This IP address has been observed attempting to exploit Cisco Smart Install Protocol.
- Sources: Rapid7, GitHub [1, 2, 3]
- See it on GreyNoise Viz
CVE-2021-35464
Tag: ForgeRock OpenAM Pre-Auth RCE Vuln Check [Intention: Unknown]
- This IP address has been observed checking for the existence of CVE-2021-35464, a path traversal vulnerability in ForgeRock OpenAM which can lead to RCE.
- Sources: PortSwigger, NIST
- See it on GreyNoise Viz
CVE-2021-35464
Tag: ForgeRock OpenAM Pre-Auth RCE Attempt [Intention: Malicious]
- This IP address has been observed attempting to exploit CVE-2021-35464, a path traversal vulnerability in ForgeRock OpenAM that can lead to RCE.
- Sources: PortSwigger, NIST
- See it on GreyNoise Viz
CVE-2021-33544 to CVE-2021-33544 (11 CVEs)
Tag: UDP Technology IP Camera Attempt [Intention: Malicious]
- This IP address has been observed attempting to exploit CVEs in UDP Technology camera firmware and has attempted exploitation.
- Sources: PortSwigger, Randorisec
- See it on GreyNoise Viz
CVE-2021-33544, CVE-2021-33548, CVE-2021-33550 to CVE-2021-33554
Tag: UDP Technology IP Camera Check [Intention: Unknown]
- This IP address has been observed attempting to exploit CVEs in UDP Technology camera firmware and has attempted exploitation.
- Sources: PortSwigger, Randorisec
- See it on GreyNoise Viz
CVE-2017-12149
Tag: Jboss Application Server RCE Attempt [Intention: Malicious]
- This IP address has been observed attempting to exploit CVE-2017-12149, a remote code execution vulnerability in JBoss Application Server.
- Sources: NIST, GitHub
- See it on GreyNoise Viz
CVE-2021-30497
Tag: Ivanti Avalanche Path Traversal [Intention: Malicious]
- This IP address has been observed attempting to use CVE-2021-30497, a path traversal vulnerability in Ivanti Avalanche that could lead to arbitrary file retrieval.
- Sources: Ivanti, SSD Disclosure
- See it on GreyNoise Viz
Tag: Double URL Encoding [Intention: Malicious]
- This IP address has been observed requesting double encoded URLs, a method commonly used for bypassing defensive rules and directory traversal.
- Sources: OWASP, Imperva
- See it on GreyNoise Viz
Tag: Apache OFBiz Deserialization RCE [Intention: Malicious]
- This IP address has been observed attempting to exploit CVE-2021-29200, a deserialization vulnerability in Apache OFBiz 17.12.07 and earlier that can lead to unauthenticated RCE.
- Sources: NIST, xz.aliyun.com, GitHub
- See it on GreyNoise Viz
Removed Tags
These tags have been removed because they no longer exist, scan, and/or can no longer be accurately identified
- RDP Bruteforcer
- Windows RDP Cookie Hijacker
- RDP Scanner
Multiple RDP tags have been deprecated in favor of RDP Crawler, which more accurately accounts for much of the behavior we see. We are currently working to create more accurate and narrowly scoped tags for RDP scanning and exploitation.
The RDP Bruteforcer tag was created around the same time as BlueKeep and aggressively assigned `malicious` intent to basic RDP connection attempts. After re-evaluating this, we feel this was incorrect and have taken actions to improve our RDP tags in general.
Tag Improvements
As part of our process, our research team continues to clean up and improve on existing tags as new information or better processes are introduced.
Tag: Cisco Smart Install Endpoint Scanner [Intention: Unknown]
- This IP address has been seen scanning for exposed Cisco Smart Install Protocol ports.
- Sources: Rapid7, GitHub [1, 2]
- See it on GreyNoise Viz
Tag: Linksys E-Series TheMoon Worm [Intention: Malicious]
- This IP address has been observed attempting to leverage the Linksys E-Series TheMoon command injection exploit.
- Sources: Computerworld, SANS, GitHub
- See it on GreyNoise Viz
Integrations
Anomali: Now supports RIOT and the Community API.
.png)
