A nil-pointer dereference vulnerability (CVE-2026-100349) in kin-openapi causes a process crash when validating response headers that declare 'content' instead of 'schema'.

An insecure direct object reference vulnerability in Cube-studio versions through 2026.09.01 allows authenticated users to perform unauthorized administrative actions on notebooks and services via sequential ID manipulation.

An insecure direct object reference vulnerability in Jeepay versions 3.2.9 and earlier allows authenticated merchant users to overwrite arbitrary payment channel configurations, enabling payment redirection or service disruption.

A vulnerability in Matomo allows a remote, authenticated attacker to disclose sensitive information, potentially leading to unauthorized data exposure.

Devolutions Server contains multiple vulnerabilities that allow a remote, authenticated attacker to bypass security controls, perform information disclosure, and escalate privileges.

Multiple vulnerabilities in Red Hat OpenShift and RHEL, involving Quarkus and Netty components, enable remote attackers to perform information disclosure or trigger denial-of-service conditions.

A vulnerability in FasterXML Jackson allows a remote, unauthenticated attacker to trigger a denial of service (DoS) condition in applications using the library for data processing.

Apache Airflow is affected by multiple vulnerabilities that could allow an attacker to bypass security measures or perform unauthorized information disclosure.

A high volume of failed tool invocations against an AWS Bedrock AgentCore Gateway may indicate an adversary attempting to discover injection points or authorization bypasses within AI agent infrastructure.

This threat brief details the detection of shell or scripting interpreters spawned by processes containing LLM prompt-injection or jailbreak language, which attackers use to coerce GenAI agents into executing malicious commands.

This threat brief details the potential for unauthorized data collection via Model Context Protocol (MCP) tools within OpenAI ChatGPT Enterprise, where attackers may leverage new or unusual connectors to exfiltrate organizational data from internal repositories.

Cisco AI Defense alerts indicate potential iterative prompt injection or unauthorized data exfiltration attempts against generative AI applications, characterized by bursts of high-risk guardrail violations.

Cisco AI Defense alerts indicate that generative AI applications have bypassed privacy guardrails, resulting in the exposure of personally identifiable information or payment card information in allowed responses.

Driftregion iso14229 versions before 0.10.1 are vulnerable to an integer wraparound in Handle_0x38_RequestFileTransfer, allowing unauthenticated attackers to trigger an out-of-bounds read.

Sliver is vulnerable to a denial-of-service attack due to a lack of size constraints during PNG image decoding in its HTTP(S) listener, allowing unauthenticated attackers to exhaust server memory.

An unauthenticated remote denial-of-service vulnerability in Qwik allows attackers to terminate Node.js server processes by sending a maliciously crafted qwik-json payload, resulting in persistent service outages.

Neterbit NW-431F LTE routers are vulnerable to unauthenticated information disclosure via the /sms.json endpoint, allowing attackers to retrieve SMS messages including potential one-time passcodes.

Multiple high-severity vulnerabilities in Eclipse Milo, including improper authorization and memory management flaws, allow unauthenticated remote attackers to bypass access controls, delete protected nodes, or crash services.

Multiple critical vulnerabilities in EseeCloud App and firmware allow remote, unauthenticated attackers to gain device control, perform unauthorized device rebinding, and perform bulk enumeration of registered IoT cameras.

Multiple critical vulnerabilities in J4Care dcm4chee-arc-light 5.35.1 enable remote, unauthenticated attackers to manipulate medical records, exfiltrate sensitive patient data, and induce denial-of-service conditions.

Multiple vulnerabilities across Symfony components, including expression-language, http-foundation, and yaml, enable remote attackers to cause a denial-of-service condition.

A vulnerability in OpenVPN allows a remote, authenticated attacker to trigger an information disclosure or a denial-of-service condition via crafted inputs.

Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.

Swetrix Cloud versions before 5.1.0 contain a missing authorization vulnerability in the ProjectController component that allows authenticated attackers to hijack arbitrary projects.

A vulnerability in IBM QRadar SIEM allows a remote, unauthenticated attacker to induce a denial-of-service condition affecting the platform availability.

A vulnerability in the BlueZ Bluetooth stack allows a remote, unauthenticated attacker to trigger a denial-of-service condition on affected Linux systems.

Multiple vulnerabilities in AMI AptioV UEFI firmware allow local attackers to achieve arbitrary code execution, data manipulation, privilege escalation, and information disclosure.

A vulnerability in Fortinet FortiOS allows a remote, unauthenticated attacker to trigger a denial of service condition on the target appliance.

Adversaries leverage nslookup within PowerShell execution flows to retrieve malicious payloads encoded in DNS TXT records, bypassing traditional network egress filtering.

Detection of Windows event log files (.evtx) created outside of standard system directories, which may indicate log tampering, data staging, or forensic evasion.

A path traversal vulnerability in Webmin and Usermin allows remote, unauthenticated attackers to read arbitrary files by exploiting improper input handling in the simplify_path function.

iFlytek SkillHub versions through 0.2.22 contain a missing authorization vulnerability in the skill deletion API, allowing authenticated users to delete any user's skill data.

Detection of NirSoft utility bundle file creation on Windows hosts, a technique frequently used by threat actors for credential harvesting, reconnaissance, and data exfiltration.

This detection identifies potential unauthorized container image pushes to AWS ECR by monitoring for 'PutImage' API calls from users not present in an established allowlist, a common indicator of supply chain or lateral movement activity.

An improper privilege management vulnerability in Python (CVE-2026-85864) allows an authorized local attacker to perform unauthorized privilege escalation.

North Korean state-controlled IT workers are scaling global employment fraud operations by utilizing domestic facilitators, KVM-over-IP hardware, and remote management tools to exfiltrate data and generate revenue.

This analytic identifies potential exploitation, command-and-control communication, or protocol abuse by monitoring Zeek logs for HTTP requests using non-standard or unexpected methods.

This analytic identifies potential adversary activity by monitoring for non-standard SSH client banners in network traffic, which can indicate the use of custom offensive tooling, tunneling utilities, or malware for C2 and lateral movement.

This detection identifies anomalous HTTP POST requests containing heavily encoded bodies, specifically using hex escape sequences or base64 character blocks often used by adversaries to obfuscate C2 traffic or exfiltrated data.

Swann Communications SWIFI-SE2KIC security cameras contain multiple authentication bypass vulnerabilities (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) that allow unauthenticated local network attackers to access live video streams and snapshots.

Adversaries modify Windows Registry keys related to Microsoft Defender Firewall 'AuthorizedApplications' to bypass network restrictions and ensure persistence for malicious binaries.

Adversaries modify specific registry keys to disable Microsoft Defender Firewall exceptions, potentially enabling unauthorized lateral movement or command-and-control communication.

Multiple vulnerabilities in the Vim text editor allow an unauthenticated attacker to achieve arbitrary code execution with the privileges of the user running the application.

This detection brief identifies potential account takeover attempts by monitoring for the provisioning of a new MFA device within one hour of a Windows password reset event.

Attackers achieve persistence and privilege escalation by modifying the Print Monitors registry key to force the system to load an arbitrary malicious DLL under SYSTEM privileges.

Adversaries use wmic.exe to enumerate local groups on Windows endpoints to identify targets for privilege escalation and lateral movement.

This brief documents the use of Windows Management Instrumentation Command-line (WMIC) for reconnaissance, specifically focusing on the 'wmic computersystem' command used by adversaries to profile system environments.

Ransomware actors, including the Cactus group, utilize the Windows Management Instrumentation Command-line (WMIC) utility to delete volume shadow copies to prevent system recovery.

This brief focuses on identifying the abuse of the WMIC utility for system information discovery, a technique frequently used by adversaries to fingerprint target environments during post-exploitation.

This brief documents the detection of WMI 'process call create' command-line patterns used by adversaries to execute arbitrary payloads and maintain persistence.

The DCRat malware uses the Windows time synchronization utility 'w32tm.exe' to introduce arbitrary delays in its execution flow, helping the threat actor evade sandbox analysis and automated detection mechanisms.

Adversaries leverage the signed Windows script Syncappvpublishingserver.vbs via wscript.exe or cscript.exe to execute remote scripts or facilitate defense evasion and privilege escalation.

Adversaries utilize the Windows native 'netsh.exe' utility to perform reconnaissance on firewall rules and network configurations to facilitate post-exploitation activities and security control bypass.

Threat actors, including APT41, abuse the native Windows HTML Help application (hh.exe) to decompile CHM files for staging malicious payloads or bypassing security controls.

The legacy Windows Resource Kit tool SubInAcl is being identified as a potential indicator of unauthorized security descriptor tampering or defense evasion on modern Windows environments.

Adversaries may use the PowerShell cmdlet Export-PfxCertificate to exfiltrate authentication certificates from the Windows Certificate Store, enabling identity impersonation and data decryption.

Adversaries abuse the PowerShell Export-Certificate cmdlet to exfiltrate authentication certificates from the Windows Certificate Store for use in credential theft and man-in-the-middle attacks.

This detection identifies the illicit extraction of authentication certificates by monitoring Windows CAPI2 logs for EventID 70, a technique commonly utilized by attackers to perform credential theft and user impersonation.

Threat actors like CL-STA-0048 abuse the legitimate sqlcmd.exe utility to conduct database reconnaissance, data theft, and unauthorized command execution on compromised Microsoft SQL Server instances.

The Snake malware utilizes the Windows Registration directory to store operational .crmlog files, enabling persistence and configuration management for its malicious activities.

Adversaries frequently terminate security and system services using built-in utilities to facilitate ransomware deployment, evade defensive monitoring, and disrupt organizational operations.

RemCom is an open-source tool functionally similar to PsExec, frequently abused by threat actors to perform lateral movement and remote command execution within Windows environments.

Detection of unauthorized Windows service configuration via modification of registry ImagePath values, a common technique for persistence, privilege escalation, and lateral movement by various threat actors.

Adversaries, including those deploying Lumma Stealer via fake CAPTCHA campaigns, utilize the Windows RunMRU registry key to execute malicious commands while masking activity as legitimate user behavior.

Adversaries utilize the sc.exe utility to create services on remote Windows endpoints to establish persistence, escalate privileges, or facilitate lateral movement.

This brief outlines the detection of unauthorized root CA certificate installation in the Windows Registry, a technique used to facilitate man-in-the-middle attacks and bypass encrypted communication security.

Threat actors, including Volt Typhoon, modify Windows registry keys to configure PortProxy via netsh, enabling persistent network traffic redirection and potential command-and-control.

The Volt Typhoon group utilizes the Windows netsh utility to establish covert network proxies, enabling persistence and traffic redirection through the portproxy interface.

This brief documents the use of the PowerView PowerShell cmdlet Get-DomainSPNTicket to conduct Kerberoasting, a technique that extracts Kerberos service tickets for offline password cracking.

Adversaries leverage the Export-PfxCertificate PowerShell cmdlet to exfiltrate sensitive certificates from the Windows Certificate Store, enabling credential theft and impersonation.

Adversaries may leverage the PowerShell cmdlet 'Export-Certificate' to exfiltrate cryptographic material from the Windows Certificate Store, enabling impersonation and decryption of sensitive data.

This analytic identifies potential credential dumping by detecting unauthorized processes requesting suspicious access masks to the Local Security Authority Subsystem Service (LSASS).

Attackers may modify Outlook registry keys related to WebView and Today features to redirect web-based components to malicious URLs, facilitating phishing and credential theft.

Attackers are abusing the legitimate Windows utility odbcconf.exe to execute arbitrary code or load malicious DLLs by utilizing response files to bypass security controls.

Attackers are abusing the legitimate Windows utility odbcconf.exe to load arbitrary DLLs via the regsvr action, enabling defense evasion and unauthorized code execution.

Attackers frequently abuse the legitimate, signed Windows utility Odbcconf.exe to execute arbitrary code or load malicious DLLs, facilitating defense evasion and persistence.

Threat actors leverage the legitimate NirSoft AdvancedRun utility to perform remote code execution, privilege escalation, and persistence on Windows systems.

Attackers modify the 'ChannelAccess' registry value to restrict event log visibility and evade detection, a technique observed in ransomware campaigns like LockBit.

Attackers are modifying the 'CustomSD' registry value in Windows EventLog channels to restrict access to logs and blind security monitoring capabilities.

Attackers utilize the Windows 'net' utility to discover and enumerate network shares as a precursor to lateral movement, privilege escalation, or data exfiltration.

Adversaries abuse the msiexec.exe /z parameter to unregister DLLs, facilitating defense evasion and disruption of security controls.

Adversaries abuse the msiexec.exe /y command-line switch to trigger the DLLRegisterServer function, facilitating malicious DLL loading for defense evasion and persistence.

Attackers utilize the MOFComp utility to compile Managed Object Format (MOF) files for establishing WMI event subscriptions, enabling persistence, lateral movement, or arbitrary code execution on Windows systems.

Adversaries, including those using Azorult malware, modify the 'Notification_Suppress' registry key to disable Windows Defender alerts and facilitate stealthy persistence.

Adversaries, including those deploying the DarkGate malware, modify the 'Internet Settings\ProxyServer' registry key to establish covert, proxied Command and Control communication channels.

Adversaries and malware, including DarkGate, modify the Windows registry key 'ProxyEnable' to redirect network traffic through a proxy for C2 communication and data exfiltration.

The ShrinkLocker ransomware family modifies the 'scforceoption' registry key to enforce mandatory smart card authentication, disrupting standard system access and manipulating security protocols.

Adversaries and malware, including RedLine Stealer, modify the Windows registry to disable automatic updates to evade security patching and maintain persistence.

Adversaries, including RedLine Stealer operators, modify the 'NoAutoRebootWithLoggedOnUsers' registry value to prevent system reboots, facilitating persistence and uninterrupted malicious operations.

The Warzone RAT malware modifies Windows registry keys related to connection limits to facilitate lateral movement and network-based attacks.

Adversaries, including the BlackByte ransomware group, modify the 'LongPathsEnabled' registry key to bypass Windows 260-character file path limitations, enabling the concealment and execution of malicious payloads.

Detection of unauthorized modifications to the EnableLinkedConnections registry key, a technique used by BlackByte ransomware to enable cross-privilege network share access.

The DarkGate malware modifies the Windows Error Reporting 'DontShowUI' registry key to 0x00000001, suppressing error dialogs to remain stealthy during malicious installation.

Adversaries, including the RedLine Stealer malware, modify Windows registry keys to disable automatic updates to facilitate evasion and prevent security patching.

Attackers, including the Azorult malware group, modify the Windows 'DisallowRun' registry key to prevent security tools from executing, thereby facilitating evasion and persistence.

Adversaries modify Windows Registry keys to disable Windows Error Reporting (WER) to suppress diagnostic notifications, thereby concealing malicious activity and reducing the likelihood of detection.

This detection identifies modifications to the Windows registry key 'DisableSecuritySettings' which lowers Remote Desktop security posture, a technique frequently used by the DarkGate malware to enable persistent unauthorized remote access.

The DarkGate malware modifies the Windows registry key 'DisableRemoteDesktopAntiAlias' to 0x00000001, disabling anti-aliasing to optimize remote control capabilities and maintain unauthorized access.

Adversaries, including the Azorult malware group, modify registry keys to disable Windows Security Center notifications as a defense evasion tactic to suppress system alerts.

Adversaries, including RedLine Stealer, modify registry keys to disable Windows Defender notifications, allowing malicious activity to proceed without alerting the user or security teams.

Adversaries, including operators of the Azorult malware, modify the Windows Registry to disable toast notifications, preventing users from receiving critical system security updates.

Adversaries, including the operators of RedLine Stealer, modify the Windows Registry to set Windows Update notification preferences to 'Notify before download' to evade security patches.

This detection identifies the creation of specific file extensions indicative of the Mimikatz 'crypto' module, which is used to export cryptographic keys and certificates during credential theft activities.

Adversaries leverage the signed binary InstallUtil.exe with the /u flag to execute arbitrary code and bypass Windows application control policies.

Adversaries abuse the Windows Credential UI DLLs to present fraudulent prompts for harvesting user credentials, a technique detectable by monitoring for suspicious module loads outside of protected system directories.

Attackers utilize the Windows built-in utility 'forfiles.exe' to execute commands against multiple files, a technique leveraged by the Prestige ransomware to facilitate post-exploitation file enumeration and malicious activity.

The Windows 'forfiles.exe' utility can be abused by attackers to execute arbitrary commands as a proxy, enabling evasion of command-line monitoring and facilitating post-exploitation activity.

Adversaries manipulate Windows WMI AutoLogger registry keys to disable logging providers and telemetry, facilitating defense evasion and persistence on compromised systems.

Adversaries may enable the built-in Windows guest account using the net.exe utility to establish persistent, low-profile access to a target system.

Attackers can achieve persistence by placing a malicious 'Get-Variable.exe' binary into the WindowsApps folder to hijack PowerShell command execution, a technique observed in the wild by the Colibri malware.

Adversaries, including those using Amadey malware, utilize Windows utilities like icacls.exe to modify file permissions, facilitating defense evasion and persistence by hindering security analysis.

Attackers utilize the PowerView 'Invoke-ShareFinder' PowerShell cmdlet to discover network file shares, potentially exposing sensitive data for lateral movement and privilege escalation.

Attackers utilize the Image File Execution Options (IFEO) registry key to intercept process execution and achieve persistence or evasion by attaching a debugger to legitimate Windows binaries.

Attackers often terminate the Windows Event Log service, documented via Event ID 1100, to disrupt auditing and obscure malicious post-exploitation activities.

Adversaries are leveraging the Azure CLI on compromised Windows hosts to manipulate Microsoft Entra ID user accounts for persistent access and stealthy operation.

Attackers, particularly ransomware operators, modify Windows Registry keys to disable critical system features and security configurations, hindering forensic response and maintaining persistence.

Adversaries leverage the AppCmd.exe utility on Windows IIS servers to disable HTTP logging as a defense evasion technique to mask post-exploitation activity.

Malware families, including Remote Access Trojans (RATs), modify Windows registry keys to disable the Notification Center, effectively suppressing system alerts to hide malicious activity.

Adversaries, specifically ransomware operators, modify Windows Registry keys to disable the logoff button, hindering incident response and forcing session persistence.

Threat actors and ransomware operators modify the Windows Registry to disable the workstation lock feature, ensuring persistent access and preventing user interference during malicious operations.

Attackers, particularly ransomware actors, modify the Windows registry to disable the Change Password feature, preventing users from regaining control of their accounts and impeding incident response.

Attackers are utilizing createdump.exe, a utility often bundled with third-party software like PowerShell 7, to dump LSASS memory for credential theft.

This analytic identifies attackers attempting to establish persistence or escalate privileges by using net.exe to add users to local administrator groups.

Detection of unauthorized local user account creation on Windows systems via event ID 4720, a technique frequently leveraged by threat actors for persistence and privilege escalation.

APT37 leverages the native Windows expand.exe utility to extract malicious CAB archives into common staging directories like C:\ProgramData as a precursor to persistence and execution.

Attackers are abusing the native Windows binary mavinject.exe to perform arbitrary DLL injection into running processes, enabling stealthy code execution and persistence.

Attackers can bypass application whitelisting policies by leveraging rundll32.exe to execute arbitrary code through specific Windows library functions, facilitating persistence and privilege escalation.

Threat actors, including Wizard Spider and FIN6, frequently abuse the legitimate AdFind.exe utility to perform unauthorized Active Directory reconnaissance to facilitate lateral movement and privilege escalation.

Attackers may reset the Directory Services Restore Mode (DSRM) administrator password on Domain Controllers to maintain persistent, high-privileged administrative access.

Detection of the deletion of the Windows Update Sequence Number (USN) Journal using the fsutil.exe utility to identify attempts by adversaries to hinder forensic investigations.

Adversaries utilize PowerShell commands to query environment variables as part of local system reconnaissance to identify the current logged-in user.

Adversaries utilize the Windows utility 'query.exe' to perform system and Active Directory user discovery for situational awareness, facilitating further lateral movement and privilege escalation.

An analytic for identifying system information discovery techniques, including the execution of wmic, systeminfo, and hostname, used by attackers to profile target environments.

Detection of reg.exe execution spawned via non-interactive command prompts to identify unauthorized registry modifications associated with persistence or defense evasion.

This detection focuses on identifying suspicious child processes spawned from 'mshta.exe', a common living-off-the-land technique used by threat actors like Lumma Stealer and MuddyWater for code execution and persistence.

The Microsoft Workflow Compiler (microsoft.workflow.compiler.exe) is being abused as a living-off-the-land technique to execute arbitrary code or maintain persistence via proxy execution.

This detection targets the suspicious lifecycle of Windows user accounts created and deleted within one hour, a technique often used by attackers to gain ephemeral unauthorized access or maintain persistence while evading long-term detection.

Attackers are abusing the Windows Application Compatibility Shim infrastructure via sdbinst.exe to intercept API calls, achieve persistence, and escalate privileges.

Attackers can use Application Compatibility Database (.sdb) files to intercept API calls, allowing for privilege escalation and persistence by bypassing Windows security controls.

Adversaries utilize schtasks.exe with remote command-line arguments to establish persistence or facilitate lateral movement across Windows environments.

This brief describes the detection of adversaries abusing 'schtasks.exe' for lateral movement and remote code execution by triggering scheduled tasks on remote Windows endpoints.

Adversaries frequently use schtasks.exe via command interpreters to establish persistence or execute malicious payloads; this detection monitors for abnormal task creation or deletion originating from non-system processes.

Adversaries leverage the rundll32.exe utility to execute malicious DLL export functions by ordinal value, a technique designed to evade standard process monitoring and security controls.

Detection of WMIC.exe utilization with the node switch, a living-off-the-land technique used by threat actors for lateral movement and remote code execution.

Adversaries and Red Teams utilize the [adsisearcher] PowerShell type accelerator to perform Active Directory reconnaissance by querying for domain computer objects.

Adversaries leverage the Windows Management Instrumentation (WMI) utility (wmic.exe) to facilitate lateral movement and remote code execution by spawning unauthorized processes on target systems.

Adversaries, including operators of Remcos and njRAT, utilize the Regsvr32 utility with silent and install parameters to load malicious DLLs for code execution and persistence.

Adversaries can abuse the Windows Application Compatibility Shim (AppCompatFlags) mechanism by modifying specific registry keys to achieve persistence, escalate privileges, or bypass security controls.

Detection of unauthorized or suspicious process spawning from WmiPrvSE.exe, a common technique for lateral movement, remote code execution, and persistence via Windows Management Instrumentation.

Adversaries abuse the PowerShell Start-BitsTransfer cmdlet to facilitate file transfers, enabling clandestine data exfiltration and payload delivery via the Background Intelligent Transfer Service (BITS).

This brief details the detection of potential lateral movement and remote code execution via the abuse of 'New-CIMSession' and 'Invoke-CIMMethod' cmdlets in PowerShell.

The execution of Get-LocalGroup via PowerShell or cmd.exe is a common discovery technique used by attackers to map local group memberships for privilege escalation.

This brief covers the detection of adversarial abuse of PowerShell COM object instantiation via GetTypeFromCLSID, a technique used for UAC bypass and privilege escalation by threat actors including ransomware operators.

Detection of the Enable-PSRemoting cmdlet usage via PowerShell Script Block logging, which attackers often employ to establish remote access and enable lateral movement within a compromised environment.

Attackers utilize PowerShell to modify or add InProcServer32 registry keys to facilitate COM hijacking, enabling arbitrary code execution, persistence, or privilege escalation.

Adversaries leverage nltest.exe to enumerate Active Directory domain trust relationships, facilitating lateral movement and network reconnaissance in post-compromise environments.

This brief details methods used by attackers to harvest sensitive credentials from macOS Keychain databases using native utilities or direct file access.

Adversaries leverage xattr and spctl utilities to bypass MacOS Gatekeeper protections, enabling the execution of untrusted or malicious binaries.

The Awfulshred wiper malware exploits the Linux System Request (SysRq) mechanism to force an immediate system reboot by writing to the proc/sysrq-trigger interface.

Adversaries perform network reconnaissance on Linux systems by rapidly enumerating network configuration and firewall settings, which this analytic detects via a 30-minute window of process execution telemetry.

Adversaries modify SSH authorized_keys files on Linux systems to establish persistent access and bypass authentication, a technique detectable through process execution monitoring.

Adversaries leverage the Linux base64 utility to deobfuscate malicious payloads and scripts, a common tactic for evading static analysis and security controls during the execution phase.

Adversaries with root privileges may abuse the Linux Magic SysRq interface via /proc/sysrq-trigger to perform unauthorized system reboots, process termination, or system destabilization.

Detection of the kmod process enumerating kernel modules, a common discovery step used by attackers to profile systems before loading malicious rootkits or kernel-level persistence.

The execution of the insmod utility on Linux systems is a high-risk indicator often associated with the deployment of rootkits for persistence and privilege escalation.

Detection of malicious actors using the curl utility on Linux systems to download remote scripts or binaries via common command-line flags.

This brief outlines the monitoring of curl and wget execution on Linux systems to detect the ingress of malicious tools, a common technique employed by adversaries for payload delivery and post-compromise activity.

Attackers can achieve container escape and escalate privileges on Linux hosts by mounting the entire host filesystem into a container with elevated privileges.

Detection of attackers using base64 decoding utilities coupled with pipe redirection to Linux shells to execute obfuscated malicious payloads.

Adversaries use the Linux 'dd' utility to perform destructive file overwriting, leading to data loss and system service disruption.

Adversaries leverage the Linux xclip command-line utility to intercept or exfiltrate sensitive information stored in the system clipboard.

Adversaries leverage service termination techniques on Linux systems to disable security controls and disrupt operations, as documented in the Industroyer2 malware campaign.

This detection targets adversary efforts to perform credential dumping on Linux systems by monitoring for the usage of standard utilities to access /etc/passwd and /etc/shadow files.

This detection monitors for the execution of the 'insmod' utility on Linux systems, a technique frequently leveraged by attackers to deploy rootkits, gain kernel-level persistence, and escalate privileges.

This detection identifies suspicious reconnaissance activity on Linux systems where utilities like find or grep are used to locate sensitive document files, a technique commonly used by attackers for data identification and exfiltration.

Adversaries utilize the dd command to irreversibly overwrite system files with null bytes, facilitating data destruction and service disruption.

Detection of adversaries utilizing the 'xclip' utility on Linux systems to exfiltrate sensitive information stored in the system clipboard.

This detection monitors for the creation of new user accounts on Linux systems, a common technique employed by adversaries to establish persistence on compromised hosts.

Attackers can abuse the Linux 'at' or 'atd' utilities to maintain unauthorized access or escalate privileges by scheduling malicious tasks.

Adversaries often create new user accounts on Linux systems using 'useradd' or 'adduser' to establish persistence and facilitate privilege escalation, which can be identified through process execution monitoring.

Adversaries leverage the Impacket wmiexec.py tool to facilitate lateral movement and remote code execution by spawning processes via wmiprvse.exe using distinct command-line obfuscation and hidden share access patterns.

Attackers abuse the Windows attrib.exe binary with the +h flag to conceal malicious files and directories from users and security software as part of a defense evasion strategy.

Adversaries utilize the Get-WmiObject cmdlet via PowerShell to perform Active Directory domain computer enumeration, facilitating lateral movement planning.

Adversaries utilize the Get-LocalUser PowerShell cmdlet for account discovery and situational awareness on compromised Windows endpoints.

Adversaries utilize the PowerView PowerShell cmdlet 'Get-DomainGroup' to perform Active Directory reconnaissance and map domain structures, facilitating subsequent privilege escalation and lateral movement.

Adversaries leverage the PowerView cmdlet 'Get-DomainGroup' via PowerShell to perform Active Directory reconnaissance and identify group memberships for lateral movement.

This detection targets the execution of the PowerShell command 'Get-DomainController', often used by attackers to enumerate domain infrastructure as part of Active Directory discovery.

Adversaries leverage the .NET WindowsIdentity.GetCurrent() method via PowerShell to perform system owner discovery, aiding in situational awareness and lateral movement.

This detection monitors for the execution of Get-WMIObject Win32_Group via PowerShell Script Block Logging to identify potential reconnaissance activity associated with group enumeration.

This detection identifies the execution of the Get-ForestTrust PowerShell command, which adversaries use to map Active Directory forest trust relationships for lateral movement and privilege escalation.

Adversaries utilize the Get-DomainUser cmdlet within the PowerView framework to perform Active Directory reconnaissance and user enumeration.

Adversaries utilize the PowerView PowerShell module's Get-DomainTrust command to perform Active Directory reconnaissance, facilitating lateral movement planning by mapping domain trust relationships.

Attackers utilize the legitimate Windows utility esentutl.exe to perform unauthorized copies of the SAM and ntds.dit files for offline credential extraction, facilitating privilege escalation and lateral movement.

Detection of the UseLogonCredential registry modification used to enable plaintext credential storage in Windows memory for post-exploitation credential dumping.

Adversaries leverage the native Windows utility dsquery.exe to map Active Directory domain trusts, facilitating lateral movement and privilege escalation.

Threat actors, including those deploying Remote Access Trojans such as NjRAT, modify Windows Registry keys to disable System Restore and hinder recovery efforts.

Malware and threat actors modify Windows registry keys to disable the Command Prompt (cmd.exe) as a defense evasion tactic to hinder incident response and system remediation.

Malware, including ransomware and RATs, frequently modifies Windows registry keys to disable Defender real-time protection to facilitate unhindered post-exploitation activity.

Attackers and malware frequently modify the Windows registry to disable the Registry Editor, preventing incident responders from manually removing malicious persistence mechanisms.

SharpHound is a widely used tool for Active Directory enumeration, enabling attackers to perform reconnaissance, map network relationships, and identify paths for lateral movement and privilege escalation.

Attackers utilize the SharpHound tool for automated Active Directory enumeration to map network structures and identify targets for lateral movement and privilege escalation.

Adversaries leverage rundll32.exe with inline protocol handlers like VBScript or JavaScript to execute fileless payloads and bypass security controls.

Attackers abuse the trusted Microsoft Regsvr32 utility to proxy malicious code execution via 'scrobj.dll', a technique commonly known as 'Squiblydoo' used to bypass application control.

The execution of PsExec with the 'accepteula' flag is a common indicator of unauthorized remote code execution and lateral movement activity by threat actors.

Attackers exploit unquoted service paths on Windows systems to achieve privilege escalation by placing malicious executables in directories that the Windows Service Controller inadvertently executes with system-level privileges.

Attackers abuse the Microsoft HTML Help utility (hh.exe) to execute arbitrary code or scripts by loading malicious Compiled HTML Help (CHM) files via InfoTech Storage Handlers.

Threat actors leverage native administrative tools such as WMIC and PowerShell to create Volume Shadow Copies, a technique used to facilitate credential dumping and offline password cracking.

Attackers utilize the net.exe utility to create or delete Windows shares as a mechanism for lateral movement, data exfiltration, and establishing persistence.

Threat actors may leverage curl with insecure flags within Kubernetes environments to bypass TLS certificate verification, facilitating man-in-the-middle attacks and unauthorized tool ingress.

Adversaries frequently abuse the legitimate Windows CertUtil utility to decode obfuscated malicious payloads, facilitating defense evasion and subsequent unauthorized code execution.

Attackers abuse the legitimate BITSAdmin utility to download and execute malicious payloads via the Background Intelligent Transfer Service, facilitating various post-exploitation activities.

Adversaries leverage the Windows Background Intelligent Transfer Service (BITS) utility bitsadmin.exe to establish persistence, download malicious payloads, or exfiltrate data by creating and scheduling jobs.

This brief documents the use of bcdedit.exe by ransomware actors to disable Windows boot-level failure recovery, inhibiting system restoration and increasing the impact of data encryption.

Detection of the Microsoft HTML Help executable (hh.exe) spawning child processes, which indicates the potential use of malicious Compiled HTML Help (CHM) files to execute arbitrary scripts and bypass security controls.

CVE-2025-12441 is an out-of-bounds read vulnerability in the Chromium V8 JavaScript engine that could potentially lead to sensitive information disclosure within the browser process.

A vulnerability in BusyBox allows an unauthenticated remote attacker to execute arbitrary code and escalate privileges, posing a significant risk to embedded Linux systems.

An unpatched vulnerability in Foreman allows a remote, authenticated attacker to manipulate arbitrary files and bypass established security controls.

Agnaistic Agnai versions 1.0.555 and earlier contain hard-coded administrative credentials and a static JWT secret, enabling unauthenticated account takeover and configuration manipulation.

An unauthenticated remote denial-of-service vulnerability in ageLANServer allows attackers to trigger excessive memory consumption by sending crafted JSON arrays to the getFileURL endpoint.

MIT Kerberos contains multiple vulnerabilities that enable a remote, authenticated attacker to trigger a Denial of Service condition on targeted systems.

A local attacker can exploit a vulnerability in Zammad to perform privilege escalation on the host system.

Malware families such as NjRAT and BlankGrabber utilize the 'ping 0 -n' command to introduce execution delays, a technique employed to evade sandbox analysis and time the self-deletion of malicious artifacts.

Attackers are abusing Windows SSH configuration features 'ProxyCommand' and 'LocalCommand' to execute arbitrary scripts and establish command-and-control channels via living-off-the-land binaries.

Threat actors abuse the Windows Task Scheduler service to execute malicious code and maintain persistence by spawning shell and scripting binaries directly from the svchost.exe service process.

Adversaries are leveraging trusted .NET utilities spawned by scripts in user-writable directories to execute code and maintain persistence, a technique observed in recent VIP Keylogger campaigns.

The Windows Program Compatibility Assistant (pcalua.exe) is being abused as a living-off-the-land binary to execute arbitrary processes and bypass command-line protections.

The DCRat malware utilizes a forkbomb technique, spawning rapid, high-volume processes of cmd.exe and notepad.exe to induce system instability and resource exhaustion.

Adversaries utilize wscript.exe with VBScript command-line arguments to execute arbitrary code and evade process monitoring defenses.

CairoSVG versions 2.9.0 and earlier are vulnerable to a CPU-exhaustion denial-of-service attack due to O(n²) complexity in SVG path-data parsing and marker rendering.

Absolute Secure Access contains multiple vulnerabilities that can be exploited by an attacker to trigger a Denial of Service condition, potentially disrupting service availability for users.

The PostgreSQL JDBC Driver is susceptible to multiple vulnerabilities, including CVE-2022-21724 and CVE-2022-31197, that allow remote attackers to manipulate data and disclose sensitive information.

A vulnerability in the Resteasy component of Red Hat Enterprise Linux allows a remote, unauthenticated attacker to disclose sensitive information.

Adversaries perform OAuth phishing by tricking users into granting malicious applications high-risk delegated scopes in Entra ID, enabling persistent, silent access to mail, files, and chat data via long-lived refresh tokens.

Adversaries may perform local privilege escalation by abusing the Windows Secondary Logon service to spawn processes with alternate user credentials.

Adversaries can establish persistence on Linux systems by modifying XDG Autostart entries to execute malicious scripts or binaries that initiate unauthorized network connections upon user login.

Adversaries may abuse the Telnet protocol to move laterally within a network, necessitating monitoring of internal Telnet connections to identify unauthorized remote access attempts.

Telnet is a legacy protocol frequently abused for unauthorized remote access and data exfiltration due to its lack of encryption, necessitating monitoring of outbound traffic to publicly routable IP addresses.

This analytic identifies potential data exfiltration risks by monitoring AWS CloudTrail logs for 'PutBucketAcl' events that grant public access to S3 buckets using the AWS CLI.

A remote, unauthenticated attacker can exploit CVE-2018-1000632 within the virtuoso-opensource package on Red Hat Enterprise Linux to trigger a denial of service condition.

An unbounded key-derivation loop in the Excelize library allows an attacker to trigger CPU exhaustion via a maliciously crafted EncryptionInfo stream in an OLE-formatted file.

Multiple vulnerabilities in X.Org X11 and Xwayland allow local attackers to execute arbitrary code or trigger a denial of service state.

An authenticated remote attacker can exploit a vulnerability in NetBox to perform information disclosure through improper request handling.

A local Denial of Service vulnerability exists in the PCRE library due to improper processing of specifically crafted regular expressions that cause application crashes.

OpenSSH is affected by multiple vulnerabilities that allow a remote, unauthenticated attacker to bypass security controls, cause a denial-of-service (DoS) condition, or perform privilege escalation on the affected system.

Adversaries may attempt to enable the Windows Subsystem for Linux (WSL) using the legitimate DISM utility to facilitate the execution of Linux-based tools and bypass Windows-specific security controls.

Adversaries may abuse compromised or legitimate SolarWinds binaries to disable security services by modifying Windows Registry 'Start' values, a technique used for defense evasion.

Adversaries manipulate the Windows PortProxy registry keys to establish unauthorized port forwarding, enabling lateral movement and the bypassing of network segmentation.

Adversaries may achieve persistence on macOS by modifying calendar (.ics) files to trigger the execution of malicious programs at recurring intervals.

Adversaries may attempt to evade detection and destroy forensic evidence by deleting critical Linux system logs, requiring monitoring of file deletion events for sensitive log paths.

Attackers can leverage misconfigured pods with hostPID enabled to gain visibility into host-level processes, facilitating container escape and privilege escalation to root on the underlying host node.

Creation or modification of Kubernetes pods with the HostNetwork attribute enabled allows containers to escape their network namespace, potentially enabling host-level traffic interception and privilege escalation.

Adversaries can exploit the hostIPC namespace in Kubernetes pods to access host-level shared memory and IPC mechanisms, enabling container escape and privilege escalation.

Attackers with initial cluster access are abusing the Kubernetes TokenRequest API to mint arbitrary service account tokens, facilitating privilege escalation, cloud resource pivoting, and persistence without leaving filesystem artifacts.

Adversaries are utilizing stolen GCP user or service account credentials to perform unauthorized AI tasks across geographically distant locations, indicating LLMjacking and credential abuse.

High volumes of GenerateContent requests from a single IP against Vertex AI models indicate potential model extraction, automated scraping, or LLMjacking attacks.

Multiple vulnerabilities in the vLLM inference engine allow an unauthenticated attacker to trigger a denial of service, impacting the availability of LLM inference services.

Adversaries are leveraging high-volume network logon failures against Windows systems to brute force or spray credentials, often targeting multiple accounts from a single source IP.

This detection identifies potential password brute force or spraying activity targeting Windows administrative accounts by monitoring for high volumes of failed network logon attempts from a single source IP.

A vulnerability in the OpenJPEG library allows a remote, unauthenticated attacker to cause a denial-of-service condition through the processing of maliciously crafted input.

Adversaries may hide malicious software such as remote-access tools from the Windows Programs and Features list by executing the HideUL utility or modifying the SystemComponent registry value.

PickMall Lilishop up to version 4.2.4 contains an improper authorization vulnerability in the Mobile Binding component, allowing remote attackers to manipulate the Username argument to bypass authorization controls.

The hickory-resolver DNS library is vulnerable to a denial-of-service condition (CVE-2025-27150) where a malicious authoritative nameserver can induce an infinite retry loop by returning truncated responses.

An unauthenticated remote denial-of-service vulnerability in @graphql-tools/utils allows attackers to crash node processes via prototype pollution in the mergeDeep utility function.

Rapid7 Velociraptor is affected by multiple vulnerabilities allowing a remote, authenticated attacker to manipulate files, bypass security controls, escalate privileges, and exfiltrate sensitive data.

A vulnerability in the Zabbix Frontend allows a remote, authenticated attacker to execute arbitrary scripts in a user's browser via a Cross-Site Scripting (XSS) attack.

A local vulnerability in the GRUB 2 bootloader allows an attacker with physical access to bypass Secure Boot and execute arbitrary code during the boot process.

This detection monitors PowerShell Script Block Logging (EventCode 4104) to identify patterns indicative of credential theft, lateral movement, and persistence used by offensive toolkits.

This detection identifies adversary defense evasion via the execution of Living Off the Land Binaries and Scripts (LOLBAS) from non-standard directory locations.

This detection identifies the creation of DLLs with a history of exploitation within common writable directories, providing visibility into potential DLL sideloading and search order hijacking attempts.

Attackers can exploit custom or native Windows protocol handlers to execute arbitrary commands, maintain persistence, or escalate privileges by abusing URI-based application launching.

Anomalous processes accessing the Windows hosts file are often indicative of malware like BlankGrabber Stealer or Gh0st RAT attempting to perform traffic redirection or DNS spoofing.

This detection analytic identifies potential DLL search order hijacking by leveraging Sysmon to monitor for the loading of known vulnerable libraries from non-standard directory paths.

Detection of anomalous processes accessing browser user data directories indicates potential credential theft attempts by various information stealers.

This brief describes the identification of Windows AppLocker policy violations, which may indicate adversary efforts to bypass application execution controls or execute unauthorized code.

Adversaries are masquerading as legitimate processes by renaming Python binaries to evade security controls and execute malicious payloads on Windows endpoints.

This analytic identifies potential defense evasion activity by detecting instances where common third-party software binaries are executed under a filename that does not match their original file name metadata.

Adversaries attempt to evade security controls by renaming standard Windows command interpreters like cmd.exe or powershell.exe to masquerade as benign files.

This brief outlines the detection of potential persistence and privilege escalation via WMI permanent event subscriptions, which attackers use to trigger malicious payloads on system events.

Adversaries leverage WMI permanent event subscriptions to achieve stealthy persistence and arbitrary code execution by binding system event filters to malicious consumers.

This detection identifies potential defense evasion by monitoring for native Windows Living Off The Land Binaries (LOLBAS) executing with non-matching original file name metadata.

Adversaries leverage KDE AutoStart scripts and desktop files to achieve persistence on Linux systems by ensuring malicious code executes automatically upon user logon.

IBM Business Process Manager contains multiple cross-site scripting vulnerabilities that allow an unauthenticated remote attacker to inject malicious scripts into user sessions.

This brief details a detection strategy for identifying non-browser User-Agent strings in web access logs, which often indicate reconnaissance, automated scanning, or exploitation attempts using scripting languages and security tools.

This detection analytic identifies Potentially Unwanted Applications by monitoring for specific HTTP User-Agent strings in web logs, which can signify unauthorized tool usage or active compromise on the network.

This analytic identifies potential C2 traffic by matching HTTP User-Agent strings from proxy or web logs against a repository of known malicious agents used by infostealers including Lokibot, Lumma, Meduza, and RedLine.

This detection identifies DNS queries from internal hosts to known dynamic domain providers, a technique frequently used by attackers to maintain flexible command-and-control infrastructure and host malicious payloads.

This detection utilizes Cisco Secure Firewall logs to identify TLS-encrypted sessions established using known malicious or blacklisted SSL certificate fingerprints associated with C2, malware, and phishing.

This detection logic identifies anomalous downloads of potentially malicious file types including executables, archives, and scripts using Cisco Secure Firewall Threat Defense telemetry.

This brief details a detection strategy for identifying the creation or connection to known malicious named pipes used by C2 frameworks like Cobalt Strike and Brute Ratel to facilitate post-exploitation communication.