Threat briefs

CISA has added CVE-2026-88779, a memory buffer vulnerability in Citrix NetScaler, to the Known Exploited Vulnerabilities (KEV) catalog due to confirmed in-the-wild exploitation.

This detection monitors PowerShell Script Block Logging (EventCode 4104) to identify patterns indicative of credential theft, lateral movement, and persistence used by offensive toolkits.

This detection identifies adversary defense evasion via the execution of Living Off the Land Binaries and Scripts (LOLBAS) from non-standard directory locations.

This detection identifies the creation of DLLs with a history of exploitation within common writable directories, providing visibility into potential DLL sideloading and search order hijacking attempts.

Adversaries may disable critical Windows audit policies to evade detection by monitoring tools, an activity identifiable through the analysis of Event ID 4719.

Attackers can exploit custom or native Windows protocol handlers to execute arbitrary commands, maintain persistence, or escalate privileges by abusing URI-based application launching.

Anomalous processes accessing the Windows hosts file are often indicative of malware like BlankGrabber Stealer or Gh0st RAT attempting to perform traffic redirection or DNS spoofing.

This detection analytic identifies potential DLL search order hijacking by leveraging Sysmon to monitor for the loading of known vulnerable libraries from non-standard directory paths.

Detection of anomalous processes accessing browser user data directories indicates potential credential theft attempts by various information stealers.

This brief describes the identification of Windows AppLocker policy violations, which may indicate adversary efforts to bypass application execution controls or execute unauthorized code.

This analytic identifies potential defense evasion activity by detecting instances where common third-party software binaries are executed under a filename that does not match their original file name metadata.

Adversaries attempt to evade security controls by renaming standard Windows command interpreters like cmd.exe or powershell.exe to masquerade as benign files.

Adversaries leverage WMI permanent event subscriptions to achieve stealthy persistence and arbitrary code execution by binding system event filters to malicious consumers.

This detection identifies potential defense evasion by monitoring for native Windows Living Off The Land Binaries (LOLBAS) executing with non-matching original file name metadata.

Detection of unauthorized modifications to Windows registry autostart keys, a common technique used by threat actors to maintain persistence across system reboots.

Adversaries leverage KDE AutoStart scripts and desktop files to achieve persistence on Linux systems by ensuring malicious code executes automatically upon user logon.

Adversaries utilize hex encoding with common Linux utilities to obfuscate malicious payloads, evading static detection during the execution stage.

This detection monitors Azure API Management GatewayLogs for sensitive credential patterns accidentally included in LLM prompts or assistant replies, flagging potential data leakage through AI services.

A vulnerability in the Linux kernel Bluetooth subsystem allows unprivileged users to gain 'trusted' status for HCI sockets by exploiting IOCTL permission check flaws, enabling unauthorized management commands.

A missing authentication vulnerability in Casdoor versions up to 3.161.1 allows remote attackers to bypass security controls via the ApiFilter function.

IBM Business Process Manager contains multiple cross-site scripting vulnerabilities that allow an unauthenticated remote attacker to inject malicious scripts into user sessions.

A vulnerability in the jQuery library allows remote, anonymous attackers to conduct a cross-site scripting (XSS) attack by exploiting DOM manipulation and event handling flaws.

A local attacker can exploit a vulnerability in Citrix Systems XenServer and Xen, tracked as CVE-2024-45815, to gain unauthorized access to sensitive information via improper security controls in the virtualization layer.

Anomalous execution pattern where Unix-based browser processes spawn shells to initiate outbound external network connections, a TTP indicative of potential drive-by exploitation or browser-based post-exploitation.

This brief details a detection strategy for identifying non-browser User-Agent strings in web access logs, which often indicate reconnaissance, automated scanning, or exploitation attempts using scripting languages and security tools.

This detection analytic identifies Potentially Unwanted Applications by monitoring for specific HTTP User-Agent strings in web logs, which can signify unauthorized tool usage or active compromise on the network.

This analytic identifies potential C2 traffic by matching HTTP User-Agent strings from proxy or web logs against a repository of known malicious agents used by infostealers including Lokibot, Lumma, Meduza, and RedLine.

This detection identifies DNS queries from internal hosts to known dynamic domain providers, a technique frequently used by attackers to maintain flexible command-and-control infrastructure and host malicious payloads.

This detection utilizes Cisco Secure Firewall logs to identify TLS-encrypted sessions established using known malicious or blacklisted SSL certificate fingerprints associated with C2, malware, and phishing.

This detection logic identifies anomalous downloads of potentially malicious file types including executables, archives, and scripts using Cisco Secure Firewall Threat Defense telemetry.