Threat briefs

This brief documents the detection logic for identifying when Windows Defender anti-malware scanning is disabled, a common TTP used by adversaries to impair system defenses.

Detection of unauthorized disabling of Windows Defender real-time protection via system-level service events.

Adversaries manipulate the ServiceDLL registry value within Windows service configurations to achieve persistence by forcing the loading of unauthorized malicious dynamic link libraries.

Adversaries manipulate Windows shell open command registry keys to facilitate User Account Control (UAC) bypass and establish persistence through file association hijacking.

Adversaries leverage the Microsoft Connection Manager Profile Installer (CMSTP) via registry modifications to achieve arbitrary code execution or bypass User Account Control (UAC).

A vulnerability in the libtasn1 library tracked as CVE-2024-11111 allows a remote, anonymous attacker to cause a Denial of Service condition, potentially impacting applications that rely on the library for ASN.1 structure processing.

A vulnerability in the GnuTLS library allows remote, unauthenticated attackers to trigger a denial of service condition in applications leveraging the library via CVE-2024-0553.

A vulnerability in Samba tracked as CVE-2024-4323 allows a remote, authenticated attacker to trigger a Denial of Service condition through specific request handling.

Multiple vulnerabilities in the pipewire and dbus-broker components of Red Hat Enterprise Linux allow an attacker to trigger a Denial of Service condition through system instability or service disruption.

A vulnerability in Apache Commons Configuration allows a remote, unauthenticated attacker to trigger a denial of service condition through improper variable interpolation handling.

Angular is affected by multiple vulnerabilities that allow attackers to perform remote code execution, cross-site scripting (XSS), information disclosure, security bypasses, and denial of service (DoS) attacks.

A vulnerability in VMware Tanzu Spring Framework identified as CVE-2024-38816 allows a remote, unauthenticated attacker to bypass security restrictions.

A vulnerability in VMware Tanzu Spring Security allows a remote, unauthenticated attacker to bypass security restrictions, potentially leading to unauthorized access to sensitive information.

The Mirage Kitten threat actor is targeting aviation and FinTech software engineers with spear-phishing campaigns distributing trojanized coding challenge archives containing cross-platform Node.js and JavaScript backdoors.

An unauthenticated stored XSS vulnerability in the Welcart e-Commerce WordPress plugin (CVE-2026-19914) allows attackers to inject malicious scripts that execute in the context of administrative sessions.

Adversaries modify Windows LegalNotice registry values to display custom ransom messages during the login process as part of an extortion campaign.

Adversaries often achieve persistence by registering malicious Windows services with binaries located in writeable or temp directories to evade detection.

Adversaries utilize native Windows utilities to enumerate local file systems for improperly stored private keys and cryptographic credentials.

Detection of the Nimgrab utility, a command-line tool often used for remote file downloads and potentially leveraged for stages of command-and-control operations.

Threat actors leverage the legitimate Microsoft signed script 'Pubprn.vbs' to proxy the execution of arbitrary scripts and evade security controls.

Detection engineering brief regarding the use of the Hashcat password recovery tool in Windows environments, which is frequently used by adversaries for credential access via offline hash cracking.

The abuse of the Unblock-File cmdlet is used by attackers to bypass Mark-of-the-Web (MotW) protections on downloaded files, facilitating the execution of malicious payloads.

Adversaries may use PowerShell to open a handle to disk volumes via DOS device paths to perform direct, unauthorized file system access or bypass security controls.

Adversaries often downgrade PowerShell execution policies to execute unauthorized scripts, bypassing security controls by invoking the Set-ExecutionPolicy cmdlet with 'Unrestricted' or 'Bypass' parameters.

Adversaries use PowerShell script blocks to enumerate active security software processes by filtering system process listings for known defensive product names and company identifiers.

Detection of the Get-ADReplAccount cmdlet from the DSInternals toolkit, which is frequently used by adversaries for unauthorized Active Directory credential dumping.

Adversaries can utilize PowerShell to programmatically create Volume Shadow Copies, enabling the offline extraction of sensitive files like the Active Directory ntds.dit database.

Adversaries utilize Windows script engines, wscript.exe and cscript.exe, to initiate outbound network connections for downloading malicious payloads or communicating with command and control infrastructure.

Detection of BITS transfer jobs saving files with potentially malicious extensions, a technique used by adversaries to download and execute payloads while evading traditional security monitoring.

A vulnerability (CVE-2026-66066) in Ruby on Rails Active Storage allows unauthenticated attackers to achieve arbitrary file read and remote code execution during the variant processing phase.