MS08-067 was a vulnerability in Windows and affected every version of Windows available at that point.
Explicit Confidence 99% · John Lambert EP 57 Details
“it affected every version of Windows up until we had at that point”
Software
software:windows
Also: Microsoft Windows, Windows OS, Windows computers, Windows devices, Windows operating systems, Windows servers
Microsoft operating system that the Trojan was able to infect despite being fully patched.
Microsoft operating system that the Trojan was able to infect despite being fully patched.
“it was able to infect a fully-patched version of Windows.”
Operating system running on computers connected to the wind turbines and affected by the mining software.
“Each of the turbines had their own Windows computer connected to it.”
“where there were Windows operating systems in the environment”
Operating system used by ATMs and bank computers in the episode.
“an ATM is just a computer running Windows”
“it really is just a Windows computer.”
Operating-system platform and environment targeted and administered during the test.
“If you’re on a Windows machine”
The operating-system platform targeted by Mimikatz, EternalBlue, and NotPetya in the episode.
“on Windows computers is a program called lsass.exe.”
“EternalBlue is an exploit to get into Windows computers.”
Microsoft operating-system product family discussed as the affected software platform.
“Microsoft found a massive bug in Windows”
Operating system whose built-in remote-control capabilities are described as being used by the reverse connection.
“It’s taking advantage of the built-in remote-control capabilities within Windows itself.”
Operating-system platform targeted by WannaCry and protected by patches for the exploited SMB weakness.
“this ransomware was targeting Windows computers”
Operating system running on the compromised jump server and involved in the credential theft described.
“This jump server was a Windows computer”
Operating-system platform described as attempting to locate shared drives and authenticate over the local network.
“the thing about Windows computers is that they always want to try to join a domain”
Microsoft operating-system software described as containing the vulnerability exploited by EternalBlue.
“this exploit in Windows, Microsoft Windows”
Operating system used by all 250 servers encrypted in the manufacturing company incident and present on the hospital devices protected by ThreatLocker.
“Yes, all Windows servers.”
“ThreatLocker was on the Windows devices”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | AFFECTS | MS08-067 | Explicit | 57 |
| incoming | AFFECTS | WannaCry | Explicit | 73 |
| incoming | AFFECTS | WannaCry | Derived | 158 |
| incoming | AFFECTS | EternalBlue | Explicit | 158 |
| incoming | INVOLVES | ThreatLocker manufacturing ransomware incident | Explicit | 167 |
| incoming | INVOLVES | ThreatLocker hospital ransomware incident | Explicit | 167 |
MS08-067 was a vulnerability in Windows and affected every version of Windows available at that point.
Explicit Confidence 99% · John Lambert EP 57 Details
“it affected every version of Windows up until we had at that point”
WannaCry targeted Windows computers, particularly network-connected computers.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware was targeting Windows computers and specifically, Windows computers that were connected to the network”
EternalBlue AFFECTS Windows
The EternalBlue exploit is described as affecting Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
WannaCry infected and encrypted Windows computers.
Derived Confidence 96% · Jack Rhysider EP 158 Details
“Their computers would get infected and then completely encrypted.”
ThreatLocker manufacturing ransomware incident INVOLVES Windows
The manufacturing-company incident encrypted all 250 Windows servers.
Explicit Confidence 98% · Guest EP 167 Details
“Yes, they were all Windows servers”
ThreatLocker hospital ransomware incident INVOLVES Windows
The threat actor gained access to a Windows server and attempted to infect it with ransomware.
Explicit Confidence 97% · Jack Rhysider EP 167 Details
“gained access to a Windows server, tried to infect it with ransomware”