tag: Scanning · 3 items
- Engineer — Learn: Emerging scanning activity targeting hospitality-sector applications is worth monitoring if you run such software, but the truncated summary provides no specific CVE, version, or patch target to act on.
- SOC/IR — Learn: New scanning pattern from SANS honeypots signals potential pre-exploitation reconnaissance; no IOCs or TTPs are provided in the available summary to turn into a detection rule today.
- Leader — Skip
- Engineer — Plan: If your environment includes any Proxmox VE 7 instances, treat them as actively targeted and prioritize upgrading to a supported version; v7 has been EOL for years and will receive no patches for this or future issues.
- SOC/IR — Learn: Opportunistic scanning is occurring against Proxmox VE 7 hosts, but no IOCs or specific exploit TTPs are published yet — worth noting for asset-aware alerting if Proxmox is in scope, but no detection action warranted now.
- Leader — Skip
- Engineer — Learn: If you expose Solana JSON-RPC or gRPC dev endpoints (e.g., surfpool) on public interfaces, audit firewall rules to ensure they are not internet-reachable; no active exploitation or PoC reported.
- SOC/IR — Learn: Awareness item: opportunistic scans targeting Solana dev endpoints are occurring, but no IOCs, TTPs, or confirmed exploitation are provided to act on.
- Leader — Skip