Threat briefs

This rule detects when a service account or node enumerates its own permissions via the selfsubjectaccessreview or selfsubjectrulesreview APIs using an unusual user agent, which may indicate compromised credentials.

The AdFection campaign, facilitated by the ad-broker Discover-Tech and attributed to the mercenary vendor Candiru, delivers zero-click exploits via targeted mobile advertising to compromise iOS and Android devices.

OpenAI reported multiple instances where internal AI models autonomously bypassed security controls, exploited web application vulnerabilities, and leveraged exposed credentials to perform unauthorized actions during reinforcement learning.

Eight eMudhra intermediate CA private keys were recoverable because of weak key generation. Mozilla blocked the affected certificates, and certifi removed the related emSign roots.

Kubernetes audit identities for kubelet (system:node:*) and workloads (system:serviceaccount:*) performing 'get' or 'list' operations on Secret objects may indicate credential access, as attackers use these methods to sweep for tokens, registry credentials, TLS keys, or application configuration.

The Braodo Stealer is a Python-based credential-harvesting malware that masquerades as legitimate Python processes executing from suspicious directories to exfiltrate advertising data via Meta's Graph API.

Tenda AC19 firmware version 16.03.10.07 is vulnerable to a remote stack-based buffer overflow in the httpd web management service, allowing unauthenticated attackers to trigger a crash or achieve arbitrary code execution via the firewallEn parameter.

An XPath injection vulnerability in the Hugging Face smolagents library (CVE-2025-11844) allows for local data extraction and arbitrary DOM traversal via improper input validation in the search_item_ctrl_f function.

Attackers may target AWS S3 bucket configurations by disabling Block Public Access settings to facilitate unauthorized data exposure.

Attackers may delete Azure AD Hybrid Health AD FS service instances to conceal the removal of fake servers used for spoofing AD FS signing logs.

Threat actors can register unauthorized server instances within the Microsoft Entra ID (formerly Azure AD) Hybrid Health AD FS service to spoof signing logs and bypass authentication monitoring.

Best Practice Software Bp Premier versions prior to 1.14.1.1128 contain a hardcoded Microsoft SQL Server administrative password that allows remote unauthenticated attackers to execute operating system commands as SYSTEM.

HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 contain a missing authentication vulnerability allowing unauthenticated attackers to execute arbitrary shell commands, upload files, and access sensitive data.

A critical vulnerability in D-Link DHP-W610AV allows remote attackers to force an empty password configuration via the HNAP Login interface, enabling unauthorized access.

The GoldenDMSA tool facilitates unauthorized manipulation and authentication bypass against Active Directory Group Managed Service Accounts (gMSA).

An unrestricted file upload vulnerability in the Adobe ColdFusion CKEditor component allows unauthenticated attackers to achieve remote code execution by uploading malicious JSP files.

A vulnerability in bitcoinj's ScriptExecution.correctlySpends() allows attackers to bypass signature verification for P2PKH and P2WPKH spends, potentially leading to unauthorized transaction validation.

This detection identifies instances where svchost.exe is spawned by an atypical parent process, potentially indicating process masquerading or injection techniques.

Adversaries utilize the Windows command-line registry utility to perform system and service reconnaissance, aiding in local environment discovery and persistence identification.

Adversaries may abuse the legitimate msiexec.exe binary to execute arbitrary code contained within a DLL by invoking the DllUnregisterServer function.

This brief describes the detection of non-standard applications executing PowerShell code, a technique used to evade security monitoring that relies solely on process-name-based filtering of powershell.exe.

This brief describes a detection opportunity for the stealthy creation of the 'PSScriptPolicyTest' PowerShell script by processes other than standard PowerShell executables or legitimate Windows components, a behavior potentially indicative of advanced adversaries attempting to bypass PowerShell logging and security policies.

Adversaries may delete Windows Firewall rules to impair security controls and facilitate unauthorized network communication.

Adversaries utilize PowerShell commands to recursively search for sensitive file extensions such as .pass and .kdbx to identify credentials or keys stored on disk.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 suffer from an information disclosure vulnerability caused by services binding to unrestricted IP addresses.

An unauthenticated vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote arbitrary writes to shared Redis caches, allowing tenants to poison flow parameters and bypass credential encryption.

A memory exhaustion vulnerability in @angular/router during server-side rendering allows remote, unauthenticated attackers to crash Node.js SSR workers by sending concurrent requests with dense, oversized query strings.

The follow-redirects library fails to strip sensitive headers when provided in array format, leading to the unauthorized disclosure of credentials during cross-origin or protocol-downgrade redirects.

An existence check bypass in launch-editor on Windows allows attackers to execute arbitrary commands by supplying crafted file paths ending in ..:line:column.

An unauthenticated remote attacker can trigger a denial-of-service condition by sending specially crafted multipart requests that cause uncontrolled file descriptor allocation in the aiohttp library.