Product
Local Privilege Escalation Vulnerability in Windows Kernel (CVE-2024-21338)
2 rules 5 TTPs 7 CVEsCVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.
Active Exploitation of Google Chromium V8 Type Confusion Vulnerability
1 TTP 2 CVEsA type confusion vulnerability in the Google Chromium V8 engine is being actively exploited in the wild, allowing remote attackers to achieve arbitrary code execution within the sandbox environment via crafted HTML pages.
CloudZ RAT Abuses Microsoft Phone Link to Steal SMS and OTPs
2 rules 1 TTPA new version of the CloudZ RAT utilizes the Pheno plugin to hijack Microsoft Phone Link connections, enabling the theft of SMS messages and one-time passwords (OTPs) from victims' mobile devices.
CloudZ RAT Abusing Windows Phone Link to Steal OTPs
2 rules 6 TTPsAn unknown attacker is using the CloudZ RAT and its Pheno plugin to hijack the Microsoft Phone Link application and intercept SMS and OTP messages from connected mobile devices, active since at least January 2026.
Persistence via Update Orchestrator Service Hijack
2 rules 3 TTPs 1 CVEDetection of potential hijacking of the Microsoft Update Orchestrator Service to establish persistence and privilege escalation by monitoring uncommon processes spawned by `svchost.exe` with `UsoSvc` as command-line parameters.
Potential CVE-2025-33053 Exploitation via Internet Explorer Diagnostics
2 rules 5 TTPs 1 CVEExploitation of CVE-2025-33053 via a malicious URL file can lead to the spawning of suspicious child processes from the Internet Explorer Diagnostics Utility (iediagcmd.exe), enabling initial access, defense evasion, and execution of arbitrary commands.