Briefs

Adianti Framework versions 5.5.0 and 5.6.0 are vulnerable to SQL injection via the SystemProfileForm name field, allowing authenticated users to manipulate database queries, modify user credentials, and potentially gain administrative access.

Aegra versions 0.9.0 through 0.9.6 are vulnerable to a cross-tenant IDOR, enabling authenticated users to execute graph runs against other users' threads, read checkpoint states, inject messages, and conceal their actions due to missing user ID validation on run creation endpoints; patched in version 0.9.7.

ArchiveBox versions 0.8.6rc0 and earlier are vulnerable to remote code execution (RCE) due to unvalidated configuration overrides in the AddView (/add/ endpoint) allowing arbitrary command execution.

Authorizer is vulnerable to unvalidated redirect URI injection in multiple endpoints, allowing attackers to steal password reset tokens, magic link tokens, and full authentication tokens by redirecting users to attacker-controlled sites.

AVideo version 29.0 and earlier is vulnerable to unauthenticated API secret disclosure via a publicly accessible endpoint, allowing unauthorized access to protected API endpoints.

An AWS account's login profile has been modified, potentially indicating account compromise, privilege escalation, or malicious user activity.

Detection of S3 bucket creation via AWS CLI which might lead to data exposure and unauthorized access.

Detection of AWS CloudTrail trail updates via the UpdateTrail API, potentially indicating malicious attempts to reduce logging visibility, change log destinations, or weaken log integrity, enabling adversaries to evade detection.

An attacker modifies or deletes AWS EC2 route tables to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment.

Detection of unauthorized changes to AWS EC2 Security Group configurations, potentially leading to persistence, data exfiltration, or lateral movement within the AWS environment.

Detection of AWS GuardDuty detector deletion via the DeleteDetector API, potentially indicating defense evasion by an attacker disabling threat monitoring and removing findings.

The rule identifies the first time a long-term IAM access key ID (prefix AKIA) is used successfully from a given source.ip in AWS CloudTrail, indicating potential credential compromise.

This brief covers detection of potential persistence techniques in AWS environments through the use of compromised user session tokens to make IAM API calls, potentially leading to unauthorized privilege escalation or resource access.

Detection of AWS users utilizing KMS keys to perform encryption operations on S3 buckets, indicating potential misuse or malicious activity within the cloud environment.

Detection of AWS RDS database instance restoration from a snapshot or S3 backup, potentially indicating unauthorized data access, defense evasion, or data collection by adversaries recreating database environments to bypass controls or exfiltrate sensitive data.

An adversary attempts to register a virtual MFA device to an AWS account, potentially leading to account takeover and unauthorized access to resources.

This rule detects the use of wget on Linux systems to upload files to an external server, a tactic commonly used for data exfiltration.

Detection of LSASS process cloning using PssCaptureSnapShot, where the parent process is also LSASS, indicating a potential attempt to dump LSASS memory for credential access.

This rule identifies PowerShell script blocks linked to multiple distinct PowerShell detections via the same ScriptBlock ID, indicating compound suspicious behavior associated with chained obfuscation, decoding, and execution within a single script block.

Adversaries may abuse Windows Installers via MsiExec to install files from remote servers for initial access and delivery of malware, which is detected by identifying MsiExec processes with network connections and specific command-line arguments.

Attackers may attempt to modify or delete critical Windows boot files such as 'winload.exe' or 'ntoskrnl.exe' to inhibit system recovery and cause data destruction, leading to a denial-of-service condition.

This rule identifies potential timestomping behavior on Windows systems where the creation time of executable files in sensitive system directories is modified, potentially to blend malicious executables with legitimate system files and evade detection.

Attackers may disable PowerShell Script Block Logging by modifying the registry to conceal their activities on the host and evade detection by setting the `EnableScriptBlockLogging` registry value to 0, impacting security monitoring and incident response capabilities.

An adversary may create a new process with a different token to escalate privileges and bypass access controls by creating a process running as SYSTEM and impersonating a Windows core binary.

Detects a suspicious sequence of an MSI installer execution immediately followed by the execution of commonly abused Remote Management Software, potentially indicating unauthorized remote access.

Detection of a Domain Managed Service Account (DMSA) creation event by a user that typically does not perform this administrative task, potentially indicating privilege escalation or account compromise.

Adversaries are leveraging mshta.exe to execute malicious scripts, and evade detection by spawning suspicious child processes such as cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, curl.exe, msiexec.exe, schtasks.exe, reg.exe, wscript.exe, or rundll32.exe.

This rule detects suspicious child processes of WerFault.exe, a Windows error reporting tool, indicating potential abuse of the SilentProcessExit registry key to execute malicious processes stealthily for defense evasion, persistence, and privilege escalation.

A machine learning job has identified a user performing privileged operations in Okta from an uncommon source IP, indicating potential privileged access activity indicative of account compromise or privilege escalation.

Adversaries may enable Windows Subsystem for Linux (WSL) via the Dism utility to evade detection by running Linux tools on Windows.