Product
SilkParasite Espionage Campaign Targeting Central Asian Governments
1 rule 3 TTPsThe SilkParasite threat actor is targeting Central Asian government entities with a modular suite of seven remote access tools delivered via spear-phishing and DLL sideloading.
Multiple Vulnerabilities in Microsoft Office Products
1 TTPMicrosoft Office products contain multiple vulnerabilities that allow a remote attacker to achieve arbitrary code execution, privilege escalation, information disclosure, file manipulation, and perform cross-site scripting (XSS) attacks.
August 2026 Microsoft Security Update Analysis
1 TTP 5 CVEsMicrosoft's August 2026 security release addresses 415 vulnerabilities, including a zero-day (CVE-2026-68820) exploited in the wild that enables local privilege escalation in the Windows Ancillary Function Driver for WinSock.
Microsoft Addresses Two Actively Exploited Zero-Day Vulnerabilities in July 2026 Patch Tuesday
8 TTPs 4 CVEs 8 IOCsMicrosoft's July 2026 Patch Tuesday addressed 622 vulnerabilities, including two actively exploited zero-day elevation of privilege flaws, CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint, allowing local and remote attackers to gain administrative control.
CVE-2026-42832 - Microsoft Office Improper Access Control Vulnerability Leading to Spoofing
2 rules 2 TTPs 1 CVECVE-2026-42832 is an improper access control vulnerability in Microsoft Office that allows an unauthorized attacker to perform local spoofing.
CVE-2026-42831 Heap-based Buffer Overflow in Microsoft Office
1 rule 1 TTP 1 CVECVE-2026-42831 is a heap-based buffer overflow vulnerability in Microsoft Office, allowing a local attacker to execute arbitrary code with a CVSS score of 7.8.
CVE-2026-40419: Microsoft Office Use-After-Free Vulnerability for Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-40419 is a use-after-free vulnerability in Microsoft Office that allows an authenticated, local attacker to elevate privileges.
CVE-2026-40363: Microsoft Office Heap-based Buffer Overflow
2 rules 1 TTP 1 CVEA heap-based buffer overflow vulnerability in Microsoft Office allows an unauthenticated, local attacker to execute arbitrary code.
CVE-2026-40358 Use-After-Free Vulnerability in Microsoft Office
2 rules 2 TTPs 1 CVECVE-2026-40358 describes a use-after-free vulnerability in Microsoft Office that could allow an unauthorized local attacker to execute code with elevated privileges.
Suspicious Process Creation Followed by Memory Access from Unknown Region
2 rules 1 TTPThe rule identifies suspicious process creation where a process is created and immediately accessed from an unknown memory code region by the same parent process, indicating a potential code injection attempt, specifically process hollowing, commonly targeting processes spawned by Microsoft Office applications, scripting engines, and command-line tools for defense evasion.
Windows Scheduled Task Creation for Persistence
3 rules 1 TTPAdversaries may create scheduled tasks on Windows systems to establish persistence, move laterally, or escalate privileges, and this detection identifies such activity by monitoring Windows event logs for scheduled task creation events, excluding known benign tasks and those created by system accounts.