Threat briefs

Adversaries frequently abuse the legitimate Windows CertUtil utility to decode obfuscated malicious payloads, facilitating defense evasion and subsequent unauthorized code execution.

Attackers abuse the legitimate BITSAdmin utility to download and execute malicious payloads via the Background Intelligent Transfer Service, facilitating various post-exploitation activities.

Adversaries leverage the Windows Background Intelligent Transfer Service (BITS) utility bitsadmin.exe to establish persistence, download malicious payloads, or exfiltrate data by creating and scheduling jobs.

This brief documents the use of bcdedit.exe by ransomware actors to disable Windows boot-level failure recovery, inhibiting system restoration and increasing the impact of data encryption.

This brief details the detection of credential dumping attempts targeting the LSASS process memory, often observed in campaigns by actors such as Scattered Lapsus$ or during ransomware deployment.

Detection of the Microsoft HTML Help executable (hh.exe) spawning child processes, which indicates the potential use of malicious Compiled HTML Help (CHM) files to execute arbitrary scripts and bypass security controls.

A use-after-free vulnerability in the GNOME mutter compositor allows local attackers to trigger crashes or arbitrary code execution via a malicious Wayland client manipulating wp_image_description_v1 resources.

LogicalDOC Community Edition versions 9.3 and earlier are vulnerable to authenticated OS command injection via maliciously crafted Velocity templates within the DocumentService.sendAsEmail function.

The Linksys E1700 router (v1.0.0.4.003) is vulnerable to a remote stack-based buffer overflow in the Mac Filter component, allowing for potential unauthenticated remote code execution.

This detection brief provides a comprehensive list of keyword signatures for identifying malicious tool and malware execution artifacts within the Windows Application event log.

Adversaries manipulate Event Tracing for Windows (ETW) using built-in administration tools to disable providers and clear logs, effectively blinding security telemetry and evading detection.

Adversaries utilize PowerShell cmdlets to disable or modify Event Tracing for Windows (ETW) providers to impair security visibility and evade detection.

An authenticated deserialization vulnerability in the ManageIQ YamlLoadAliases module allows attackers to achieve remote code execution by exploiting a silent fallback to unsafe YAML loading.

jshERP versions through 3.6 contain a missing authorization vulnerability in the UserController updateUser handler, allowing authenticated users to escalate privileges or modify other users' roles.

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission identifiers.

The mac-shell-mcp package before version 2.0.0 is vulnerable to OS command injection via malicious prompt manipulation of execute_command arguments, allowing unauthorized code execution.

Ollama versions up to 0.34.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the Pull API component allowing remote attackers to perform unauthorized internal requests.

Multiple high-severity vulnerabilities in HPE Networking AOS-Switch could allow unauthenticated attackers to achieve remote code execution, perform unauthorized actions, or cause denial of service.

A remote SQL injection vulnerability in the Zen Cart PayPal IPN Handler component allows unauthenticated attackers to execute arbitrary SQL commands via the txn_id parameter.

The agno-agi agno library is vulnerable to a remote authentication bypass in the get_authentication_dependency function, allowing unauthenticated access via crafted security_key arguments.

CVE-2025-0611 is a high-severity object corruption vulnerability in the Chromium V8 engine that could allow remote arbitrary code execution via a malicious web page.

CVE-2025-12441 is an out-of-bounds read vulnerability in the Chromium V8 JavaScript engine that could potentially lead to sensitive information disclosure within the browser process.

Multiple vulnerabilities in Dell System Update (DSU) allow local or remote attackers to achieve remote code execution and gain elevated privileges on affected Windows systems.

A vulnerability in BusyBox allows an unauthenticated remote attacker to execute arbitrary code and escalate privileges, posing a significant risk to embedded Linux systems.

Rocket Remote Desktop contains a vulnerability that allows an attacker to disclose sensitive information, specifically credentials stored within configuration files.

A local attacker can exploit a vulnerability in the Common Unix Printing System (CUPS) to cause a denial-of-service condition affecting the printing service.

An unpatched vulnerability in Foreman allows a remote, authenticated attacker to manipulate arbitrary files and bypass established security controls.

An authenticated attacker can exploit a vulnerability in SmarterTools SmarterMail to bypass security controls and hijack other user accounts via identity impersonation.

A local privilege escalation vulnerability (CVE-2022-45451) in the Acronis ngscan.sys minifilter driver allows low-privileged attackers to perform arbitrary file reads and interact with sensitive registry keys.

A SQL injection vulnerability in the login processing component of the krupalshah EmployeeRecruitmentSystem allows remote attackers to execute arbitrary SQL commands via the email or password fields.