Threat briefs

This rule identifies when multiple different alerts involving the same user are triggered, which could indicate a compromised user account and requires further investigation.

This detection identifies PowerShell scripts leveraging Win32 APIs for memory allocation, process access, and thread creation, indicative of potential process injection or in-memory payload execution on Windows systems.

CVE-2026-4708 is a high-severity vulnerability involving incorrect boundary conditions in the Graphics component, impacting Firefox versions earlier than 149, Firefox ESR versions before 140.9, Thunderbird versions before 149, and Thunderbird versions prior to 140.9, potentially leading to a denial-of-service.

CVE-2026-35228 is a critical vulnerability in Oracle MCP Server Helper Tool versions 1.0.1 through 1.0.156, allowing unauthenticated remote attackers to execute arbitrary SQL commands.

The Lazarus Group is distributing a new variant of the Dacls RAT targeting macOS systems via a trojanized application, installing a hidden executable and attempting persistence.

CVE-2026-32150 describes a race condition vulnerability in the Function Discovery Service (fdwsd.dll) that allows a locally authorized attacker to elevate privileges on a Windows system.

A machine learning job has detected an unusually high number of processes started within a single Remote Desktop Protocol (RDP) session, potentially indicating lateral movement activity.

Detection of attempts to disable or modify the code signing policy on Windows systems using built-in utilities like bcdedit, potentially allowing attackers to execute unsigned malicious code.

Adversaries may execute processes from unusual Windows directories to masquerade malware as legitimate software and evade defenses.

ORY Oathkeeper before 26.2.0 is vulnerable to authentication bypass (CVE-2026-33496) due to cache key confusion in the `oauth2_introspection` authenticator, allowing attackers with a valid token to bypass authentication by reusing it with different introspection URLs.

PraisonAI versions 4.5.138 and earlier are vulnerable to arbitrary code execution due to the automatic import and execution of a `tools.py` file from the current working directory, allowing attackers to execute arbitrary Python code.

PraisonAI versions before 4.5.139 and praisonaiagents versions before 1.5.140 are vulnerable to arbitrary command execution via untrusted YAML files processed by the workflow engine.

Detects the renaming of automation script interpreter processes like AutoIt, AutoHotkey, and KIX32, a tactic used by malware operators to evade detection by obscuring the true nature of the executable.

The Scriban template engine is vulnerable to a denial-of-service attack due to missing validation in the `string.pad_left` and `string.pad_right` functions, allowing unauthenticated attackers to trigger excessive memory allocation and crash the service by sending a crafted HTTP request to a vulnerable endpoint that processes untrusted Scriban templates.

A script interpreter such as node.exe or bun.exe spawning a credential scanning tool like trufflehog or gitleaks indicates potential credential compromise, as seen in the Shai-Hulud campaign.

An integer overflow in the `smallbitvec` crate leads to an undersized heap allocation, enabling heap buffer overflows through safe APIs, affecting versions 1.0.1 through 2.6.0.

A low-privileged user can achieve remote code execution in vulnerable Splunk Enterprise and Cloud Platform versions by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory.

A threat actor can create a new, rogue AD Health ADFS service within Azure and then create a fake server instance, which can be leveraged to spoof AD FS signing logs without compromising on-prem AD FS servers.

Detects suspicious child processes spawned by Microsoft Outlook, commonly associated with spear phishing attacks and the execution of malicious payloads.

Tandoor Recipes versions prior to 2.6.4 allow unauthorized modification and deletion of RecipeBooks due to a flaw in the CustomIsShared permission class which grants write access to shared users regardless of intended read-only permissions.

A path traversal vulnerability exists in Tenda CH22 version 1.0.0.6(468), affecting the R7WebsSecurityHandler function within the httpd component, allowing remote attackers to access sensitive files.

A remote OS command injection vulnerability exists in the Totolink A8000RU router version 7.1cu.643_b20200521, allowing attackers to execute arbitrary commands by manipulating the 'tty_server' argument in the 'setAdvancedInfoShow' function.

Detection of svchost.exe executing with uncommon command-line parameters, excluding known legitimate patterns, which may indicate file masquerading, process injection, or process hollowing.

A machine learning job detected a suspicious Windows process, predicted malicious by the ProblemChild model and flagged as an unusual child process name for its parent, potentially indicating LOLbins usage and evading traditional detection.

Vikunja is vulnerable to an IDOR in TaskAttachment.ReadOne(), allowing cross-project file access and deletion by exploiting the lack of task ID validation, potentially leading to confidentiality breaches and data loss.

An unusual spike in web server error codes (500, 502, 503, 504) may indicate reconnaissance activities like vulnerability scanning or fuzzing, where attackers probe for weaknesses, potentially leading to exploitation of server-side issues.

Attackers modify the Windows Defender registry settings to disable the service or set the service to be started manually, evading defenses.

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion (CVE-2026-6248) due to insufficient validation and sanitization, allowing authenticated users to delete arbitrary files on the server, potentially leading to remote code execution.

WWBN AVideo versions 29.0 and below are vulnerable to cross-origin credentialed requests to API endpoints due to an incomplete CORS origin validation fix, potentially exposing sensitive user data.

WWBN AVideo platform versions up to 26.0 generate weak 512-bit RSA keys for PGP 2FA, which can be easily factored to derive the private key and bypass the second authentication factor. Additionally, key generation endpoints lack authentication checks, exposing the system to resource exhaustion attacks.