Threat briefs

Attackers utilize the MOFComp utility to compile Managed Object Format (MOF) files for establishing WMI event subscriptions, enabling persistence, lateral movement, or arbitrary code execution on Windows systems.

Detection of Hermetic Wiper malware activities involving the manipulation of Windows registry keys 'ShowCompColor' and 'ShowInfoTip' to alter file visibility and UI elements.

Adversaries, including those using Azorult malware, modify the 'Notification_Suppress' registry key to disable Windows Defender alerts and facilitate stealthy persistence.

Adversaries, including those deploying the DarkGate malware, modify the 'Internet Settings\ProxyServer' registry key to establish covert, proxied Command and Control communication channels.

Adversaries and malware, including DarkGate, modify the Windows registry key 'ProxyEnable' to redirect network traffic through a proxy for C2 communication and data exfiltration.

The ShrinkLocker ransomware family modifies the 'scforceoption' registry key to enforce mandatory smart card authentication, disrupting standard system access and manipulating security protocols.

Adversaries and malware, including RedLine Stealer, modify the Windows registry to disable automatic updates to evade security patching and maintain persistence.

Adversaries, including RedLine Stealer operators, modify the 'NoAutoRebootWithLoggedOnUsers' registry value to prevent system reboots, facilitating persistence and uninterrupted malicious operations.

The Warzone RAT malware modifies Windows registry keys related to connection limits to facilitate lateral movement and network-based attacks.

Adversaries, including the BlackByte ransomware group, modify the 'LongPathsEnabled' registry key to bypass Windows 260-character file path limitations, enabling the concealment and execution of malicious payloads.

Detection of unauthorized modifications to the EnableLinkedConnections registry key, a technique used by BlackByte ransomware to enable cross-privilege network share access.

The DarkGate malware modifies the Windows Error Reporting 'DontShowUI' registry key to 0x00000001, suppressing error dialogs to remain stealthy during malicious installation.

Adversaries, including the RedLine Stealer malware, modify Windows registry keys to disable automatic updates to facilitate evasion and prevent security patching.

Attackers, including the Azorult malware group, modify the Windows 'DisallowRun' registry key to prevent security tools from executing, thereby facilitating evasion and persistence.

Adversaries modify Windows Registry keys to disable Windows Error Reporting (WER) to suppress diagnostic notifications, thereby concealing malicious activity and reducing the likelihood of detection.

This detection identifies modifications to the Windows registry key 'DisableSecuritySettings' which lowers Remote Desktop security posture, a technique frequently used by the DarkGate malware to enable persistent unauthorized remote access.

The DarkGate malware modifies the Windows registry key 'DisableRemoteDesktopAntiAlias' to 0x00000001, disabling anti-aliasing to optimize remote control capabilities and maintain unauthorized access.

Adversaries, including the Azorult malware group, modify registry keys to disable Windows Security Center notifications as a defense evasion tactic to suppress system alerts.

Adversaries, including RedLine Stealer, modify registry keys to disable Windows Defender notifications, allowing malicious activity to proceed without alerting the user or security teams.

Adversaries, including operators of the Azorult malware, modify the Windows Registry to disable toast notifications, preventing users from receiving critical system security updates.

Adversaries, including the operators of RedLine Stealer, modify the Windows Registry to set Windows Update notification preferences to 'Notify before download' to evade security patches.

This detection identifies the creation of specific file extensions indicative of the Mimikatz 'crypto' module, which is used to export cryptographic keys and certificates during credential theft activities.

Adversaries leverage the signed binary InstallUtil.exe with the /u flag to execute arbitrary code and bypass Windows application control policies.

Adversaries abuse the Windows Credential UI DLLs to present fraudulent prompts for harvesting user credentials, a technique detectable by monitoring for suspicious module loads outside of protected system directories.

Attackers utilize the Windows built-in utility 'forfiles.exe' to execute commands against multiple files, a technique leveraged by the Prestige ransomware to facilitate post-exploitation file enumeration and malicious activity.

The Windows 'forfiles.exe' utility can be abused by attackers to execute arbitrary commands as a proxy, enabling evasion of command-line monitoring and facilitating post-exploitation activity.

Adversaries manipulate Windows WMI AutoLogger registry keys to disable logging providers and telemetry, facilitating defense evasion and persistence on compromised systems.

Adversaries leverage the AppCmd.exe utility on Windows IIS servers to disable HTTP logging as a defense evasion technique to mask post-exploitation activity.

Adversaries may enable the built-in Windows guest account using the net.exe utility to establish persistent, low-profile access to a target system.

Attackers can achieve persistence by placing a malicious 'Get-Variable.exe' binary into the WindowsApps folder to hijack PowerShell command execution, a technique observed in the wild by the Colibri malware.