Potential exposure to Kaseya VSA Agent ransomware attack

critical Nessus Plugin ID 151424

Language:

Synopsis

Detects potential IoCs for Kaseya VSA Agent ransomware attack.

Description

This plugin detects the potential presence of agent.exe or agent.crt IoC's on remote host machines. This can indicate that the host might have been targeted in the Kaseya VSA ransomware attack. It is strongly recommended that the results are manually verified and appropriate remediation actions taken, if the compromise is confirmed.

Note that Nessus has not tested for this issue but has instead looked for specific files that could potentially indicate compromise.

Solution

Please refer to vendor advisory.

Plugin Details

Severity: Critical

ID: 151424

File Name: kaseya_ioc_july_2021.nbin

Version: 1.76

Type: local

Agent: windows

Family: Windows

Published: 7/6/2021

Updated: 4/23/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: Score from a more in depth analysis done by tenable

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:kaseya:vsa_agent

Required KB Items: SMB/ARCH, installed_sw/Kaseya Agent

Detections

Analytics