Threat briefs

This brief outlines the identification and response strategy for Remote File Inclusion (RFI) attacks, where adversaries exploit web server vulnerabilities to fetch remote payloads or disclose sensitive local files.

Adversaries perform virtual machine fingerprinting by using grep to query hardware manufacturer identifiers, a technique used by malware like Pupy RAT for sandbox and virtualization evasion.

Attackers utilize standard command-line tools like grep and pgrep to enumerate installed security software on macOS and Linux, enabling situational awareness for post-compromise activity.

Adversaries may use the kubectl command-line tool to enumerate sensitive secret objects across all Kubernetes namespaces to facilitate credential theft, privilege escalation, or lateral movement.

Detection of command-line obfuscation where attackers insert excessive whitespace sequences to evade signature-based security monitoring tools.

Adversaries perform timestomping on Linux and macOS systems using the touch command to modify file timestamps and evade forensic detection.

Adversaries utilize trailing space characters in binary filenames to masquerade as legitimate system tools, exploiting file handling behaviors to disguise malicious activity.

Adversaries may attempt to evade detection by renaming the kubectl binary or executing it from non-standard directories while retaining command-line functionality to perform unauthorized Kubernetes operations.

Attackers may force HTTP protocol downgrades from secure versions like HTTP/2 to legacy versions to exploit header parsing inconsistencies and facilitate request smuggling or cache poisoning.

Adversaries utilize trailing space characters in filenames on Linux and macOS to obfuscate malicious file types and deceive users into executing them.

Adversaries are leveraging Generative AI tools and agent frameworks to autonomously generate and compile malicious executables or droppers directly on compromised endpoints.

Adversaries are targeting configuration files of popular GenAI tools to inject malicious Model Context Protocol (MCP) servers, enabling persistence, arbitrary command execution, and data exfiltration.

The misuse of permission-bypass or auto-approval flags in GenAI CLI agents disables critical human-in-the-loop guardrails, creating significant risks for prompt injection and unauthorized autonomous system modification on developer workstations.

Adversaries utilize ROT-encoded Python scripts within packages to obfuscate malicious logic and evade security analysis on Windows and macOS systems.

Adversaries manipulate shell command-line history files and environment variables on Unix-like systems to evade detection and hinder post-compromise forensic analysis.

This threat brief details the detection of potential agent spoofing, where an adversary hijacks an Elastic Agent ID to inject illegitimate data or masquerade activity across multiple hosts.

Adversaries are utilizing compromised credentials and stolen session tokens to perform rapid, automated secret harvesting across AWS, GCP, Azure, and Kubernetes environments from singular source IP addresses.

This threat brief details the identification of recursive grep activity on Linux and macOS used by adversaries or insiders to discover credentials, keys, and tokens within the filesystem.

Threat actors may leverage the legitimate open-source tool 'Gitleaks' to perform unauthorized secret scanning on compromised hosts to identify and exfiltrate sensitive credentials from source code repositories.

Attackers are increasingly leveraging GenAI agent processes to perform unauthorized discovery, harvesting of sensitive credentials, and establishment of persistence via shell configuration modifications.

Adversaries leverage compromised dependencies in Node.js or Bun development workflows to perform anomalous DNS lookups for command-and-control, staging, or exfiltration activities.

This detection capability correlates Palo Alto Networks (PANW) firewall command and control alerts with Elastic Defend endpoint events to identify the specific process responsible for network traffic flagged as malicious.

This brief documents techniques used to abuse the Kubernetes kubectl CLI for command and control or data exfiltration by manipulating network configurations through port-forwarding and proxying.

Adversaries are exploiting Google Drive by appending parameters to download URLs that instruct the service to bypass antivirus scanning, facilitating the delivery of malicious payloads.

Detection rule monitors GenAI tools and CLI package managers for network connections to high-risk Top-Level Domains frequently utilized by threat actors for C2 infrastructure.

Adversaries leverage Node.js 'child_process' modules to spawn 'curl' or 'wget' for malicious payload delivery, a technique frequently used to facilitate command-and-control by piping remote content directly into local shell interpreters.

This brief covers the detection of the sqlmap automated penetration testing tool, which is frequently used by adversaries to perform reconnaissance and exploit SQL injection vulnerabilities in web applications.

CISA has added CVE-2025-39964 and CVE-2026-53266, two actively exploited Linux kernel vulnerabilities, to its Known Exploited Vulnerabilities catalog.

CVE-2025-1302 is a critical remote code execution vulnerability in the jsonpath-plus library, exploitable via malicious JSONPath expressions injected through query parameters.

An unauthenticated remote attacker can exploit CVE-2026-91149 in Cockpit by exhausting system resources through numerous simultaneous connections to the cockpit-tls service.