Detects vulnerability exploitation attempts in AhnLab EPP V3 malware alert logs.

Overview

Priority	High
Type	Stream
Log schema	ahnlab-epp-v3-malware
Message	안랩 EPP V3 권한상승 취약점 공격 탐지: 호스트 $host_ip, 악성코드 $signature
Output field order	_log_time, hostname, host_ip, emp_name, dept_name, signature, file_path, file_status, md5
MITRE Techniques	T1068 Exploitation for Privilege Escalation
MITRE tactics	TA0004 Privilege Escalation

Query

The AhnLab V3 antivirus engine detects exploit files using signatures such as Exploit/Win.CVE-2022-24521.C5317859, Exploit/Win.Generic.C4467937, etc. Therefore, alerts are extracted when the signature value begins with Exploit/. However, Exploit/Win.MagicLineX is excluded because it is detected for the purpose of removing vulnerable software, not as a malicious exploitation attempt.

Target logger models

• AhnLab EPP syslog

Threat analysis

• The Exploit/ signature family refers to malicious code or exploit files that attempt to abuse vulnerabilities in the operating system or applications for privilege escalation.
• The presence of this detection indicates that an attacker may have already attempted to elevate privileges within the system or that an exploit payload has been introduced.
• Some exploits may lead to secondary malicious actions, such as installing additional malware, creating backdoors, or bypassing system protections, making immediate investigation and containment essential.

False positives

• Detections may occur when exploit files are legitimately used during vulnerability scanning, penetration testing, or internal red-team activities.
• Aside from Exploit/Win.MagicLineX, vulnerable software associated with the Korea Internet & Security Agency (KISA) vulnerability cleaning service may also trigger detections.

Response actions

• Verify whether the detected file was actually executed, and analyze the file path and creation timestamp to determine if exploitation was successful.
• Examine system event logs, process creation records, and any signs of privilege escalation to assess the scope of compromise.
• Check whether similar exploitation attempts have occurred on other endpoints within the same network.
• Apply the latest OS and application patches, and strengthen EDR/security configurations to block exploitation attempts.