Threat briefs

Detects FortiGate SSL VPN logins followed by a SIEM detection alert for the same user within a short timeframe, potentially indicating VPN abuse, credential compromise, or initial access followed by post-compromise activity.

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability allowing authenticated users with System Manager role to execute arbitrary code via frame introspection and `os.popen`.

Free5GC PCF versions prior to 1.4.3 are vulnerable to an authentication bypass due to missing middleware, allowing unauthenticated access to SM policy handlers and disclosure of subscriber SUPI.

FreeFloat FTP Server 1.0 is vulnerable to a buffer overflow in the STOR command handler, enabling remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload.

A stored cross-site scripting (XSS) vulnerability exists in FreeScout versions prior to 1.8.213 within the mailbox signature feature due to an incomplete HTML tag blocklist and failure to remove event handler attributes.

Detection of frequent role activation in Azure Privileged Identity Management (PIM) by the same user may indicate potential privilege escalation or account compromise.

Froxlor is vulnerable to PHP code injection due to unescaped single quotes in the userdata.inc.php generation via the MysqlServer API, where an administrator with `change_serversettings` permission can inject arbitrary PHP code, leading to arbitrary OS command execution as the web server user.

Detection of failed MFA challenges in Google Cloud Platform (GCP) using Google Workspace login failure events, potentially indicating credential compromise and unauthorized access attempts.

Detection of Google Cloud Platform (GCP) service account deletion, which adversaries may perform to disrupt business operations.

An adversary may create a new key for a service account in Google Cloud Platform (GCP) to abuse the permissions assigned to that account and evade detection, potentially leading to persistent access.

This rule detects modifications to Google Cloud Platform (GCP) storage bucket configurations, potentially indicating an adversary attempting to weaken security controls for unauthorized access or data exfiltration.

The creation of a virtual private cloud (VPC) route in Google Cloud Platform (GCP) can indicate an adversary attempting to impact the flow of network traffic for defense evasion.

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to 1.2.2, allowing unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution by exploiting a nopriv AJAX route and uploading malicious ZIP files.

Detection of user logins originating from geographically distant locations within a short timeframe, indicative of potential Remote Employment Fraud or compromised credentials.

Attackers can establish persistence by placing a malicious Get-Variable.exe in the WindowsApps folder, hijacking the legitimate PowerShell cmdlet and executing upon PowerShell window initialization, as seen with the Colibri malware.

Detection of activity on a private GitHub repository from an unusual IP address, potentially indicating unauthorized access or exfiltration attempts.

Detection of classic branch protection rules being disabled in GitHub Organizations, potentially indicating an attempt to bypass security controls and inject malicious code.

This analytic detects when classic branch protection rules are disabled in GitHub Organizations, potentially allowing malicious actors to bypass code review and security controls.

An attacker disables GitHub Dependabot security features to prevent automatic detection of vulnerable dependencies, potentially leading to code execution, data theft, or other compromises through the software supply chain.

The disabling of two-factor authentication (2FA) in GitHub Enterprise, detected via audit logs, weakens account security and increases the risk of account takeover and supply chain compromise.

A user disabling audit log event streaming in GitHub Enterprise could indicate an attacker attempting to prevent their malicious activities from being logged and detected.

An attacker disables audit log event streaming in GitHub Enterprise to evade detection by preventing security monitoring platforms from receiving audit events.

Detection of modifications or disabling of audit log event streaming in GitHub Enterprise, potentially indicating an attacker attempting to evade detection by tampering with the audit trail.

A user pausing the audit log event stream in GitHub Enterprise, potentially indicating an attempt to evade detection by disabling audit trails.

An attacker disables classic branch protection rules in GitHub Enterprise, potentially to bypass code review and security controls leading to code tampering, vulnerability introduction, or supply chain compromise.

An IP allow list was disabled in GitHub Enterprise, potentially allowing unauthorized access to sensitive code repositories and GitHub Enterprise resources from untrusted networks.

Anomalous creation of self-hosted runners in GitHub Enterprise indicates potential attacker activity to execute malicious code, access sensitive data, or pivot to other systems via compromised runners.

A self-hosted runner was created in GitHub Enterprise, which could be exploited by attackers to execute malicious code, access sensitive data, or pivot to other systems.

The disabling of two-factor authentication (2FA) in GitHub Organizations is detected through audit log monitoring, potentially indicating an attacker's attempt to weaken account security and facilitate unauthorized access.

Detection of GitHub Organizations where the two-factor authentication (2FA) requirement has been disabled, potentially indicating an attempt to weaken security controls and increase the risk of account compromise.