CPE
Information Disclosure Vulnerability in Microsoft 365 Copilot
1 TTP 1 CVEA vulnerability identified as CVE-2024-38148 in Microsoft 365 Copilot allows remote, unauthenticated attackers to potentially access unauthorized sensitive information within the service environment.
Privilege Escalation Vulnerability in Microsoft Windows Package Manager
1 CVEA local privilege escalation vulnerability in the Microsoft Windows Package Manager allows an authenticated local attacker to gain elevated privileges on the host system.
Suspicious Child Processes of consent.exe
1 rule 3 TTPs 1 CVEDetection of unauthorized child process creation by the Windows UAC consent.exe binary, a common indicator of UAC bypass and privilege escalation activity.
DNS Kerberos Coercion Attempt Detection
3 rules 3 TTPs 4 CVEs 4 IOCsThis brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.