Wiz Defend Uses Cloud Context to Correlate Threats Across Environments
Summary
Wiz describes how its Defend product correlates cloud risk, runtime and audit-log data to investigate threats, citing PAN-OS exploitation and Wiz telemetry on vulnerable, exposed appliances.
Key points
- The article says CVE-2024-0012 enables authentication bypass on exposed PAN-OS management interfaces, while CVE-2024-9474 enables privilege escalation and remote code execution.
- Wiz reports that 24% of enterprise cloud environments had vulnerable virtual PAN-OS devices when the flaws were disclosed; 7% had exposed management interfaces.
- Wiz says one in three environments with internet-exposed vulnerable appliances had malware infection within 24 hours of the proof-of-concept exploit’s publication.
- Wiz describes identifying exposed vulnerable instances, analyzing attached disks without agents, and correlating findings with cloud activity to investigate possible compromise.
- Wiz Defend is presented as combining security-graph context, eBPF sensor data and cloud-provider audit logs to correlate detections into threat timelines and graphs.
- The article also promotes Wiz Defend’s breach-readiness analysis, cross-layer detections, investigation guidance and response capabilities.
Article Details
- Event Type
- Wiz announced Wiz Defend, a cloud-native security operations offering, and described its use in detecting and investigating exploitation of PAN-OS vulnerabilities.
- Impact
- The article reports that CVE-2024-0012 and CVE-2024-9474 were exploited in the wild, enabling authentication bypass and privilege escalation leading to remote code execution on exposed PAN-OS management interfaces. Wiz reports that 24% of enterprise cloud environments it assessed contained vulnerable virtual PAN-OS devices, 7% exposed the management interface to the Internet, and one-third of environments with exposed vulnerable appliances had malware within 24 hours of proof-of-concept publication. The article presents Wiz Defend as providing agentless scanning, threat correlation, investigation context, and response guidance.
CVE
CVE-2024-0012exploited in the wild as a 0-day several days later, chains together two vulnerabilities: the first, CVE-2024-0012, enables malicious actors to bypass authentication to the PAN-OS management interface if its publiclyCVE-2024-9474to bypass authentication to the PAN-OS management interface if its publicly exposed. The second, CVE-2024-9474, allows for privilege escalation and ultimately remote code execution. With RCE achieved, threat
Vendors
Palo Alto NetworksThe exploitation in the wild of the recently disclosed vulnerabilities in Palo Alto’s PAN-OS provides a good example of how cloud-native SecOps should work in practice. PAN-OS is the software powering Palo Alto’sWizOur core belief at Wiz is that the key to effective cloud security is context. With Wiz Cloud, we provided cloud security teams with critical risk context to identify, prioritize, and remediate their most important
Products
PAN-OSCase Study: PAN-OS Remote Code Execution CampaignWiz CloudOur core belief at Wiz is that the key to effective cloud security is context. With Wiz Cloud, we provided cloud security teams with critical risk context to identify, prioritize, and remediate their most importantWiz Defendwith critical risk context to identify, prioritize, and remediate their most important risks fast. Now, Wiz Defend brings that same approach to security operations – giving SecOps teams the context they need to detect,