Index / Exploitation for Priv-Esc / Undisclosed security vendor
Bypass Record

Exploitation for Priv-Esc × Undisclosed security vendor Unnamed endpoint security product

A publicly-reported instance of Exploitation for Priv-Esc bypassing Undisclosed security vendor Unnamed endpoint security product, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
Undisclosed security vendor Unnamed endpoint security product
Technique
Exploitation for Priv-Esc
MITRE ATT&CK
T1068
Confidence
Medium
Severity
Critical
Status
in the wild
Disclosed
2024-02-28
Config / version noted
Not stated

Provenance

Reported as

the primary security software from an undisclosed vendor was bypassed

Mechanism

Attackers exploited CVE-2023-38035, an authentication bypass in Ivanti MobileIron Sentry leading to remote code execution as root, to gain initial access. They deployed web shells and remote access tools, moved laterally across networks, and coordinated ransomware deployment on workstations and virtualization infrastructure (ESXi/Hyper-V) within a five-minute window.

Detection & mitigation

Monitor /var/log/portal_access_log for status 200 requests to /mics/services/MICSLogService. Deploy endpoint detection rules for web shell creation and unusual process execution from web server processes. Ensure timely patching of internet-facing appliances.

Exploitation for Priv-Esc has also been recorded against

AppleAtlassianBitdefenderBroadcom (Symantec)Comodo SecurityConnectWiseCrowdStrikeElasticESETF5FortinetGoogle

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.