McAfee coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

技术文章 ID: KB94710
上次修改时间: 7/23/2021

环境

McAfee Endpoint Security (ENS) Threat Prevention 10.x

摘要

Recent updates to this article

Date	Update
July 23, 2021	Updated the Expert Rule to reduce false positives.
July 22, 2021	Initial publication.

McAfee is aware of the "HiveNightmare/SeriousSAM" vulnerability, CVE-2021-36934, and is investigating product countermeasures. This article will be updated as we learn more.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

解决方法

To block the vulnerability from being exploited, you can implement the following ENS user-defined Expert Rule.

Rule Name	Block CVE-2021-36934: 'HiveNightmare/SeriousSam'
Severity	High
Action	Block Report
Rule type	Files
Rule content	Rule { Process { Include AggregateMatch -xtype "ex1" { Exclude VTP_PRIVILEGES -type BITMASK { -v 0x8 } } Include AggregateMatch -xtype "ex2" { Exclude GROUP_SID { -v "S-1-16-16384" } Exclude GROUP_SID { -v "S-1-16-12288" } } Include AggregateMatch -xtype "ex3" { Exclude OBJECT_NAME { -v "vssadmin.exe" } } } Target { Match FILE { Include OBJECT_NAME { -v "\\windows\\system32\\config\\SAM" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SYSTEM" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SOFTWARE" } Include OBJECT_NAME { -v "\\windows\\system32\\config\\SECURITY" } Include -access "READ" } } }

解决方法

Microsoft's Security Response Center recommends restricting access to the contents of %windir%\system32\config\ and deleting any Volume Shadow Copy Service (VSS) shadow copies that were created before restricting access. For more information, see: Microsoft update guide on CVE-2021-36934.

受影响的产品

Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Vulnerability Response

语言:

此文章有以下语言版本：

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

技术术语词汇表

突出显示词汇表术语

请花点时间浏览一下我们的技术术语词汇表。

Knowledge Center

McAfee coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

环境

摘要

解决方法

解决方法

相关信息

受影响的产品

语言:

技术术语词汇表

Title

Title

Knowledge Center

McAfee coverage for July 2021 CVE-2021-36934 "HiveNightmare/SeriousSAM" vulnerability

环境

摘要

解决方法

解决方法

相关信息

受影响的产品

语言:

技术术语词汇表

选择您的区域

Title

Title