Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The adage ‘an ounce of prevention is better than a pound of cure’ applies to AppSec vulnerability management. Traditionally, AppSec has focused on a reactive ‘curing flaws’ paradigm, identifying and fixing vulnerabilities after they have occurred. However, the never-ending escalation between threats and security leads to alert fatigue and security debt.

On July 23rd the notorious Russian-language hacking forum XSS.is was seized by French law enforcement agencies. Interestingly, just a few hours before the takedown, Cyberint, now a Check Point Company researchers were informed by “Loki,” a well-known moderator on BreachForums, that one of XSS’s admins had allegedly been arrested by the French. This follows a series of actions by French authorities, who have arrested BreachForums admins over the past few months.

Hats off to the great work the community and industry has done regarding the “ToolShell” attack against Microsoft’s On-Premise SharePoint servers. The goal of this article is to build on that great work and help Sumo Logic customers with on-prem SharePoint servers investigate and identify evidence within their environments.