Windows Print Spooler Elevation of Privilege Vulnerability - 20240423…

…002 (#667)

docs/advisories/20240423002-Windows-Print-Spooler-Elevation-of-Privilege-Vulnerability.md

@@ -0,0 +1,28 @@
+# Windows Print Spooler Elevation of Privilege Vulnerability - 20240423002
+
+## Overview
+
+Microsoft Threat Intelligence has identified a custom tool used by Forest Blizzard (STRONTIUM) refered to as GooseEgg, which is used to elevate privileges and peform credential theft on compromised networks.
+
+## What is vulnerable?
+
+| CVE                                                               | Severity | CVSS | Product(s) Affected                                                                                                      | Summary                                                                                | Dated               |
+| ----------------------------------------------------------------- | -------- | ---- | ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | ------------------- |
+| [CVE-2022-38028](https://nvd.nist.gov/vuln/detail/CVE-2022-38028) | **High** | 7.8  | Multiple Microsoft Windows Products listed [here](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-38028) | Successful exploitation of this vulnerability could lead to gaining SYSTEM privileges. | 20th December, 2023 |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- [Download Windows Security Update](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-38028)
+
+## Additional References
+
+- [CVE-2022-38028 | Tenable®](https://www.tenable.com/cve/CVE-2022-38028)
+- [Microsoft: APT28 hackers exploit Windows flaw reported by NSA (bleepingcomputer.com)](https://www.bleepingcomputer.com/news/security/microsoft-russian-apt28-hackers-exploit-windows-flaw-reported-by-nsa-using-gooseegg-tool/)
+- [NVD - CVE-2022-38028 (nist.gov)](https://nvd.nist.gov/vuln/detail/CVE-2022-38028)
+- [Analyzing Forest Blizzard's custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/)