Threat briefs

An authentication bypass vulnerability in lamp-cloud versions 5.10.0 and earlier allows unauthenticated attackers to exfiltrate sensitive JVM system properties via insecurely whitelisted API endpoints.

A heap-based buffer overflow in the Moore Threads MTT S80 driver (mtdispkm64.sys) allows a local attacker to potentially achieve privilege escalation or system instability via a crafted IOCTL request.

jshERP 3.6 contains an improper access control vulnerability in the updateOneValueByKeyIdAndType endpoint allowing authenticated users to escalate privileges to tenant administrator.

ColorFul iGameCenter version 1.0.3.4 contains an untrusted pointer dereference vulnerability in the ene.sys driver that can be leveraged by local attackers for privilege escalation.

Hatchet versions before 0.91.1 contain an OAuth state CSRF vulnerability that allows unauthenticated attackers to hijack sessions by exploiting improper session state clearing during callback processing.

Multiple vulnerabilities in Docker sandbox environments allow a local attacker to execute arbitrary code and bypass security restrictions.

A critical remote code execution vulnerability, CVE-2024-39331, exists in GNU Emacs and Red Hat Enterprise Linux, enabling unauthenticated attackers to execute arbitrary code through crafted file processing.

Adversaries and malware, including Trickbot and APT actors, leverage plain HTTP POST requests to exfiltrate sensitive system information, such as process lists and network configurations, to remote C2 infrastructure.

Detection logic identifying internal hosts performing broad network reconnaissance by scanning 250+ unique IP addresses across NMAP's top 20 common ports.

The RoguePlanet malware utilizes the Windows Error Reporting process to create hidden Alternate Data Streams in the temporary directory to facilitate malicious code execution.

Adversaries install and load known vulnerable Windows kernel-mode drivers to achieve privilege escalation or kernel-level persistence.

This brief outlines the detection of unauthorized processes attempting to access sensitive Outlook credentials stored within the Windows registry, a technique commonly employed by info-stealing malware to compromise email accounts.

This brief details the detection of malicious Windows Event Log clearing using the native wevtutil utility, a common technique employed by ransomware groups to obstruct forensic investigations.

Adversaries may use the legitimate Windows Task Manager utility to create a memory dump of the Local Security Authority Subsystem Service (LSASS) process to harvest sensitive credentials.

Detection of programmatic configuration modifications on Cisco IOS XE devices via the WebUI WSMA process associated with the Salt Typhoon campaign.

Adversaries leverage WMI token impersonation to gain elevated privileges, a behavior detectable by monitoring specific process access masks requested by wmiprvse.exe.

Detection of malicious processes attempting to terminate the Local Security Authority Subsystem Service (lsass.exe) using the PROCESS_TERMINATE access mask to facilitate system instability or disable security controls.

Detection of malicious process injection attempts into common Windows executables observed in frameworks like SliverC2 using suspicious access masks in Sysmon EventID 10 logs.

This brief describes the detection of unauthorized processes requesting full access to winlogon.exe, a technique used by the Rubeus tool to extract Kerberos tickets from memory.

This detection logic identifies credential dumping attempts by monitoring for unauthorized processes requesting PROCESS_VM_READ access to the lsass.exe process memory using Sysmon EventID 10.

Adversaries may abuse the macOS osascript utility to execute interactive shell commands for persistence or post-exploitation activities by invoking bash with interactive flags.

Adversaries abuse the macOS osascript utility to execute JavaScript for Automation (JXA) combined with Objective-C bridges to perform post-exploitation activity on macOS systems.

Adversaries may abuse the native 'osascript' utility on macOS to establish long-lived command-and-control channels or remote network connections, which can be identified by analyzing flow duration metadata.

This brief details the detection of malicious bulk virtual machine termination on VMware ESXi hosts using command-line utilities, a tactic frequently observed during ransomware staging or deliberate service disruption.

This analytic identifies instances where network traffic, specifically using prohibited ports and protocols such as FTP or Telnet, is allowed by Cisco Secure Firewall, signaling potential misconfigurations or unauthorized activity.

An ACL resolution flaw in pki-core allows unauthorized privilege escalation within the CA profile-management REST API by incorrectly prioritizing wildcard permissions over specific literal permissions.

Threat actors are distributing a credential-stealing payload via fake GitHub repositories that uses a legitimate Microsoft-signed driver to disable security software via kernel-level process termination.

A stack-based buffer overflow in fetchmail's NTLM support allows a malicious mail server to trigger memory corruption and potential remote code execution via a crafted Type 2 challenge.

A logic flaw in the oc-mirror tool allows remote attackers to bypass PGP signature verification, enabling the injection of malicious release payloads into disconnected registries.

The Rapuncel infostealer campaign uses SEO-poisoned GitHub repositories to deliver malicious installers that deploy a kernel-level EDR killer to disable security products and harvest sensitive data.