"LizaMoon" Detection Added to Nessus, PVS and LCE
Nessus plugin 29871 has been updated to look for the presence of malicious JavaScript on a remote web site.
(See Attack on ASP site that uses a SQL server database)
Below is an example of the plugin report:
Click for larger image
The Passive Vulnerability Scanner (PVS) has also been updated with plugin ID 5880, which will look for the malicious URL in transit across the network and fire an alert.
The Log Correlation Engine has been updated to include a TASL to look for queries that match the query being used in the LizaMoon attacks. For example, the SQL query used in the injection attacks has presented itself as:
surveyID=91+update+usd_ResponseDetails+set+categoryName=REPLACE(cast(categor |
(From: Attack on ASP site that uses a SQL server database)
The query used by LizaMoon is not unique to this particular malware so the TASL script will pick up similar SQL injection attacks.
Related Articles
How To Assess the Cybersecurity Preparedness of IT Service Providers and MSPs
December 13, 2022Improperly evaluating the cybersecurity capabilities of prospective IT service providers and managed service providers (MSPs) can put your organization's data and systems at risk. A new guide from CompTIA can help you ask the right questions.
A Holiday Story, Internet Edition: The Impact Of Assessing And Addressing Log4j Installations Proactively
December 30, 2021A look at our log4j data.
Apache Log4j Flaw Puts Third-Party Software in the Spotlight
December 12, 2021Even in the most mature organizations, addressing the issue, also known as Log4Shell, requires a complex mix of software development practices, vulnerability management and web application scanning.
Tenable Cyber Watch: China’s ‘Volt Typhoon’ Targets U.S. Critical Infrastructure, BEC Attacks Skyrocket, and more
June 5, 2023This week’s edition of the Tenable Cyber Watch unpacks the White House’s updates to its National AI R&D Strategic Plan and addresses the recent surge in business email compromise scams. Also covered: CISA’s warning about Volt Typhoon, the hackers backed by the Chinese government that have been targeting U.S. critical infrastructure.
CVE-2023-34362: MOVEIt Transfer Critical Zero-Day Vulnerability Exploited in the Wild
June 2, 2023Discovery of a new zero-day vulnerability in MOVEit Transfer becomes the second zero-day disclosed in a managed file transfer solution in 2023, with reports suggesting that threat actors have stolen data from a number of organizations.
Cybersecurity Snapshot: Will AI Kill Us All? How Can You Boost Identity Security? Do You Use a Framework for Cloud Security?
June 2, 2023Check out a hair-raising warning from AI experts. Plus, find out why securing identities is getting harder than ever – and how to fix it. Also, how a cloud security framework can help you – a lot. In addition, check out nifty SaaS security tips. And much more!
- Log Analysis
- Nessus
- Passive Network Monitoring