Threat briefs

Adversaries with compromised AWS credentials can exploit EC2 export APIs to copy entire virtual machine states or images to external storage for data exfiltration.

Adversaries with compromised credentials may modify AWS Lambda configurations by injecting unauthorized layers to establish persistence, run arbitrary code, or intercept data.

Adversaries with unauthorized access to AWS Simple Email Service (SES) credentials may verify an attacker-controlled identity, send phishing or spam emails, and promptly delete the identity to evade detection and attribution.

Adversaries may use the CreateTrail API to establish unauthorized logging configurations that redirect audit data to attacker-controlled destinations or circumvent existing monitoring controls.

Adversaries modify AWS VPC security group ingress rules to permit unrestricted external access to sensitive management ports, facilitating remote access or future exploitation of cloud instances.

Adversaries with administrative access to AWS GuardDuty may delete publishing destinations to break security finding exports, effectively blinding SOC monitoring without triggering detector-disabling alerts.

The deletion of AWS CloudTrail trails via the DeleteTrail API is a high-risk indicator of defense evasion or sabotage used to eliminate audit visibility.

This detection brief addresses the risk of unauthorized access to sensitive credential and secret files stored in AWS S3 buckets, a common tactic for credential harvesting and lateral movement.

Adversaries leverage misconfigured S3 bucket policies to perform unauthenticated data collection, discovery, and manipulation using tools like the AWS CLI without authentication.

Adversaries may attempt to gain elevated privileges on Unix-like systems by using the echo command to inject NOPASSWD directives into the sudoers file, allowing passwordless execution of commands as root.

Threat actors are exploiting web application command injection vulnerabilities to execute arbitrary code by submitting crafted HTTP requests containing interpreter invocations, downloader utilities, or shell commands.

This brief describes a detection capability designed to identify cloud assets exhibiting poor security posture by correlating high volumes of vulnerabilities, exploitable findings, and critical-severity bugs reported by the Wiz Cloud Security Platform.

Improper configuration of the Ollama LLM server can expose the API to the internet without authentication, enabling remote attackers to conduct model theft, prompt injection, and resource hijacking.

Adversaries manipulate endpoint hosts files to intercept network traffic, enabling malicious infrastructure redirection or the disruption of security services such as MFA.

Adversaries gaining unauthorized workflow trigger access can abuse GitHub Actions runners to execute arbitrary system commands, potentially leading to credential harvesting, reconnaissance, and CI/CD supply chain compromise.

Adversaries leverage standard command-line tools like curl or wget to perform unauthorized discovery and credential access by querying sensitive Kubernetes API endpoints directly, bypassing legitimate management tooling.

Adversaries performing hands-on-keyboard enumeration within compromised containers are detected by correlating interactive process execution with forbidden Kubernetes API audit responses.

This brief details how attackers exploit Local File Inclusion (LFI) vulnerabilities on web servers such as Nginx, Apache, IIS, and Traefik, by using directory traversal or direct sensitive file path requests to disclose system information, credentials, and configuration files, potentially leading to remote code execution and system compromise.

Adversaries may perform unauthorized impersonation within Kubernetes clusters by executing the 'kubectl' command-line tool with sensitive flags like '--as' or '--token' to escalate privileges or bypass access controls.

Adversaries often delete web server access logs to destroy forensic evidence and evade detection after unauthorized activity, a behavior monitorable through file deletion events on common web server log paths.

Adversaries leverage the legitimate OpenSSL command-line utility to encrypt sensitive files for ransomware extortion or to obfuscate data prior to exfiltration.

Attackers with initial code execution on cloud-hosted virtual machines query the Instance Metadata Service (IMDS) at 169.254.169.254 to harvest sensitive instance details and temporary security credentials for unauthorized cloud control-plane access.

Attackers exploit cloud instance metadata service (IMDS) endpoints by using command-line tools to exfiltrate temporary security credentials and sensitive configuration data, facilitating unauthorized access to cloud resources.

Threat actors harvest cloud and container platform authentication tokens by abusing legitimate CLI utilities to output secrets to standard streams, which can be detected via anomalous multi-provider access patterns.

Adversaries leverage Linux-based systems to coerce Windows hosts into authenticating against attacker-controlled resources via SMB named pipes, facilitating NTLM hash capture and SMB relay attacks.

Adversaries can exploit Chromium-based browser remote debugging features to extract authentication cookies and hijack active web sessions.

Adversaries with code execution on Azure Virtual Machines abuse the host-only WireServer endpoint at 168.63.129.16 to exfiltrate sensitive configuration data, certificates, and VM settings.

This detection leverages cross-platform correlation between FortiGate network application logs and endpoint telemetry to identify processes acting as SOCKS proxies for potential command and control obfuscation.

The YS LeadGen plugin for WordPress versions 2.1.4 and earlier contains an unauthenticated information exposure vulnerability allowing the retrieval of form submission data.

The ProfilePress WordPress plugin is vulnerable to arbitrary shortcode execution in versions up to 4.17.2, allowing authenticated users with subscriber-level access to execute arbitrary shortcodes.