Briefs

Adversaries leverage the POSIX shell 'trap' built-in to bind malicious payloads to interrupt signals, enabling automated execution for persistence or privilege escalation when specific signals are received.

Adversaries may attempt to escalate privileges on Unix-like systems by modifying the sudoers configuration file to grant unauthorized users or groups elevated permissions.

Adversaries may use chmod or install to set SUID or SGID bits on files, allowing malicious code to execute with elevated privileges for persistence or escalation.

Adversaries modify SSH authorized_keys files to establish persistent access and facilitate lateral movement by injecting unauthorized public keys for password-less authentication.

Adversaries maintain persistence on Linux and macOS systems by modifying shell configuration files to execute malicious payloads automatically upon user login or shell session initialization.

This detection rule identifies potential account compromise by correlating three or more distinct machine learning alert triggers associated with the same non-system influencer field.

Detection engineering logic that correlates Elastic Defend endpoint alerts with network security events from PAN-OS, FortiGate, and Suricata to identify potentially compromised hosts based on multi-source telemetry.

This detection capability monitors for lateral movement by identifying sequences where a host IP address from one security alert subsequently appears as the source IP in alerts from a different host.

Detection rule identifies first-time seen USB storage devices mounted on Windows and macOS endpoints to help analysts monitor for potential initial access, lateral movement, or data exfiltration.

This detection logic identifies suspicious subprocess activity originating from software package manager installation processes (npm, pip, uv, poetry, cargo) to surface potential supply-chain compromises.

This detection rule identifies suspicious endpoint activity, such as malicious file creation or shellcode execution, originating from or triggered by AI-assisted coding and assistant tools indicating potential supply chain or prompt injection abuse.

This detection capability monitors for unauthorized resource hijacking, such as cryptomining or exploit payload execution, by identifying new processes exhibiting sustained CPU usage above 90 percent.

A cross-platform detection methodology correlates security alerts with processes exhibiting sustained high CPU utilization to identify potential resource abuse or post-compromise activity.

This detection logic identifies potentially malicious activity where a Python process rapidly spawns multiple shell commands via '-c' arguments for host profiling, discovery, or lateral movement.

This brief outlines detection logic for identifying reverse shell activity on Unix-like systems by monitoring shell processes for suspicious command-line network device redirection.

Attackers exploit misconfigured privileged containers using host bind-mounts to escape container isolation and gain unauthorized control over the underlying host.

This intelligence brief details a behavioral detection strategy for identifying widespread malware infections by correlating alerts across multiple endpoints to facilitate rapid incident response.

AI coding assistants including OpenClaw, Moltbot, and Clawdbot are being weaponized via malicious 'ClawHub' registry skills to execute unauthorized system commands and exfiltrate cryptocurrency and credential data.

Adversaries are targeting Kubernetes pods to steal service account tokens and certificates, subsequently using them for cluster-wide reconnaissance and lateral movement.

Adversaries may move laterally or perform reconnaissance by compromising a container and using interactive shells or networking utilities to query the Kubernetes API server directly.

This brief outlines detection strategies for unauthorized guest execution via the Azure Virtual Machine Run Command feature, which attackers may abuse to run arbitrary scripts without interactive access.

This brief outlines the identification and response strategy for Remote File Inclusion (RFI) attacks, where adversaries exploit web server vulnerabilities to fetch remote payloads or disclose sensitive local files.

Adversaries perform virtual machine fingerprinting by using grep to query hardware manufacturer identifiers, a technique used by malware like Pupy RAT for sandbox and virtualization evasion.

Attackers utilize standard command-line tools like grep and pgrep to enumerate installed security software on macOS and Linux, enabling situational awareness for post-compromise activity.

Adversaries may use the kubectl command-line tool to enumerate sensitive secret objects across all Kubernetes namespaces to facilitate credential theft, privilege escalation, or lateral movement.

Adversaries utilize the 'kubectl auth can-i' command to enumerate effective permissions and identify security misconfigurations within Kubernetes clusters, facilitating unauthorized access and privilege escalation.

Detection of command-line obfuscation where attackers insert excessive whitespace sequences to evade signature-based security monitoring tools.

Adversaries perform timestomping on Linux and macOS systems using the touch command to modify file timestamps and evade forensic detection.

Adversaries utilize trailing space characters in binary filenames to masquerade as legitimate system tools, exploiting file handling behaviors to disguise malicious activity.

Adversaries may attempt to evade detection by renaming the kubectl binary or executing it from non-standard directories while retaining command-line functionality to perform unauthorized Kubernetes operations.