Threat briefs

The 3CX supply chain attack involved the distribution of trojanized software updates to facilitate unauthorized network access and potential data exfiltration.

Detection of loading known vulnerable Windows drivers that may indicate persistence or privilege escalation attempts via exploitation.

This analytic identifies the use of suspicious named pipes on Windows systems, a technique commonly leveraged by malware and post-exploitation frameworks for inter-process communication.

This brief details a detection strategy for identifying the creation or connection to known malicious named pipes used by C2 frameworks like Cobalt Strike and Brute Ratel to facilitate post-exploitation communication.

Detection logic targeting the creation, modification, or enabling of Windows Scheduled Tasks that utilize known malicious or suspicious naming conventions often associated with persistence and payload execution.

This brief details the detection of unauthorized processes or tools interacting with named pipes associated with Remote Monitoring and Management (RMM) software, a technique used for persistence and command-and-control.

This detection analytic identifies the creation or interaction with named pipes associated with potentially unwanted applications (PUAs) or administrative utilities that attackers leverage for lateral movement, command-and-control, or process injection.

This detection analytic identifies suspicious PowerShell activity by monitoring command-line strings for patterns associated with known offensive security toolkits used for credential theft, lateral movement, and persistence.

Adversaries frequently repurpose legitimate NirSoft administrative utilities for credential theft, reconnaissance, and system monitoring on Windows endpoints.

This detection targets threat actors attempting to evade security defenses by renaming native Windows binaries to circumvent signature-based detection or security policy enforcement.

This analytic identifies potential DLL sideloading or search order hijacking by monitoring for the loading of known abuse-prone DLLs from non-standard directory paths on Windows endpoints.

Adversaries move native Windows .NET binaries to unconventional directories to bypass security controls and facilitate malicious code execution or persistence.

This brief details the ingestion and correlation of Microsoft Defender Attack Surface Reduction (ASR) events to identify policy bypasses, configuration tampering, and malicious execution attempts.

Adversaries frequently attempt to disable security-related services on Windows endpoints using standard administration tools to facilitate defense evasion and destructive activity.

This detection identifies potential defense evasion and privilege escalation by monitoring Windows AppLocker for repeated execution block events indicating unauthorized software usage.

This detection targets anomalous DNS activity where endpoints initiate connections to external AI service providers like Hugging Face or OpenAI, which may indicate data exfiltration or the use of AI APIs for command-and-control communication.

Detection of unauthorized removal of success or failure audit policies on Domain Controllers, a critical defense evasion tactic used by attackers to hide malicious activity.

Attackers modify the Access Control List of the AdminSDHolder object in Active Directory to establish domain persistence and escalate privileges by leveraging the automated Security Descriptor Propagator process.

This brief addresses the detection of Windows system processes executing from unexpected file paths, a technique frequently used by threat actors for masquerading and defense evasion.

This detection identifies potential credential exposure caused by users inadvertently typing passwords into the username field during authentication, which can lead to account compromise or unauthorized access.

Detection of previously unseen child processes spawned by Zoom clients may indicate exploitation of the application for code execution or unauthorized system access.

This detection monitors for the configuration of known remote access utilities within Windows registry persistence locations to identify potential adversary activity aimed at maintaining long-term control.

This brief details the detection of potential privilege escalation in Azure Active Directory where attackers assign highly privileged roles to service principals to maintain persistent, elevated cloud access.

Threat actors are suppressing evidence of account compromise by receiving and then hard-deleting emails related to sensitive banking, payroll, or credential changes within Office 365 environments.

This detection brief identifies potential unauthorized AWS resource provisioning by monitoring for the creation of EC2 instance types that have not been previously observed in an organization's environment.

This analytic identifies potential unauthorized access or credential misuse by detecting API calls performed by AWS 'AssumedRole' entities that deviate from historical behavioral baselines.

Detection of unauthorized omission of mandatory security jobs within CircleCI workflows which could indicate an attacker attempting to bypass CI/CD pipeline integrity checks.

Attackers can leverage the Microsoft SQL Server xp_cmdshell extended stored procedure to execute arbitrary OS commands, facilitating privilege escalation and persistence.

This brief identifies the abuse of the Windows Installer process, msiexec.exe, by adversaries to establish persistence via scheduled tasks, startup folders, and registry autorun keys.

Monitoring for unusual process access requests to the Local Security Authority Subsystem Service (LSASS) using specific GrantedAccess flags, a common indicator of credential dumping attempts.