Threat briefs

Detection of the Volume Shadow Copy API library (vssapi.dll) being loaded by unauthorized processes, a common indicator of ransomware activity targeting backup shadow copies.

Adversaries, such as the DripLoader malware, are abusing the lack of integrity checks in Electron applications to execute malicious native code via unsigned .node modules.

This brief details a detection capability for monitoring the creation of Portable Executable files using Sysmon Event ID 29 to identify unauthorized binary drops.

Detection of unauthorized or suspicious creation of AWS IAM access keys by one user for another, a technique used for persistence and privilege escalation.

A NULL pointer dereference vulnerability in the GStreamer RTSP support library allows remote, unauthenticated attackers to trigger a denial of service by sending a malformed RTSP request containing specifically crafted whitespace in Digest authentication headers.

An authorization bypass vulnerability in the _sess_nowait function of NousResearch hermes-agent version 0.18.0 allows remote attackers to gain unauthorized access by manipulating the session_id argument.

zlib versions 1.3.1.2 through 1.3.2 are susceptible to a heap-based buffer overflow in the gz_vacate function, which can be triggered by specific non-blocking write operations to achieve memory corruption.

A vulnerability in util-linux allows unprivileged local users to perform arbitrary bind mounts and change file ownership or permissions by exploiting a race condition in SUID mount(8) handling of fstab entries.

A stack-based out-of-bounds write vulnerability in the gfs2_edit utility allows arbitrary code execution via crafted GFS2 filesystem images.

A critical buffer overflow vulnerability (CVE-2026-85031) in the TOTOLINK CP450 web interface allows remote, unauthenticated attackers to execute arbitrary code via the 'topicurl' argument.

Attackers leverage the Windows Volume Shadow Copy Service (VSS) to bypass file system locks and access sensitive credential stores like NTDS.dit or registry hives.

Adversaries frequently utilize script interpreters such as cscript, wscript, and mshta from non-standard or user-writable directories to execute malicious payloads while evading security controls.

Attackers utilize output redirection to local administrative shares as a stealthy method to stage malicious scripts or tools within a compromised environment.

This brief documents patterns in file naming conventions frequently associated with attacker toolkits, proof-of-concept exploits, and red team frameworks.

Detection of credential access attempts targeting the Local Security Authority Subsystem Service (LSASS) process via command-line arguments indicative of memory dump creation.

Adversaries are leveraging tools like winapiexec to execute Windows API functions directly from the command line to bypass traditional binary-based detection methods.

Adversaries are utilizing the native Windows script GatherNetworkInfo.vbs to perform system reconnaissance and collect network configuration data.

Threat actors utilize deceptive filenames with double extensions or whitespace padding to trick users into executing malicious binaries via spearphishing campaigns.

Adversaries are leveraging legitimate Windows command-line tools such as PowerShell, curl, and wget to collect system information and exfiltrate data via HTTP POST requests.

Adversaries frequently copy Living-off-the-Land Binaries (LOLBins) from protected system directories to arbitrary locations to evade security controls that rely on path-based allowlisting.

Adversaries often leverage Windows scheduled tasks to establish persistence or execute code with NT AUTHORITY\SYSTEM privileges, a technique commonly observed in various malware campaigns.

Adversaries frequently leverage scheduled tasks to maintain persistence or execute malicious payloads by invoking commands from temporary directories or utilizing obfuscated PowerShell/scripting patterns.

Detection of potentially malicious scheduled task creation or modification using specific trigger types that often bypass standard administrative activity monitoring.

Adversaries utilize the Windows Task Scheduler to execute obfuscated PowerShell commands retrieved from Registry keys to maintain persistence and execute payloads.

Adversaries utilize the legitimate Windows component comsvcs.dll via rundll32.exe to perform unauthorized process memory dumps, typically targeting the LSASS process to extract credentials.

Detection of an adversary technique involving the invocation of the Windows Stored User Names and Passwords dialogue to access or export cached credentials.

Adversaries may rename the legitimate createdump.exe utility to evade detection while performing unauthorized process memory dumps for credential access.

Adversaries can exploit the Windows Network Provider architecture by registering malicious DLLs to intercept and dump cleartext credentials during user authentication events.

Detection of adversaries modifying the UserInitMprLogonScript registry value to establish persistence via logon scripts.

Adversaries frequently target Windows Registry keys related to Terminal Services to enable remote access, bypass session restrictions, or weaken security layers during lateral movement and persistence.