Automation

This brief details a detection strategy for identifying non-browser User-Agent strings in web access logs, which often indicate reconnaissance, automated scanning, or exploitation attempts using scripting languages and security tools.

A threat actor utilized autonomous AI agents to compress weeks of manual intrusion tradecraft into a 10-hour campaign, involving API exploitation, secrets harvesting, and hijacking of CI/CD and AI infrastructure.

A vulnerability in Red Hat ansible-core allows local attackers to achieve arbitrary code execution through improper input handling.

An unauthenticated remote attacker can bypass mTLS authentication in the aap-gateway component of Event-Driven Ansible to inject arbitrary events and trigger automated workflows.

CrowdStrike introduces agentic MDR and SOC Transformation Services, combining deterministic automation, adaptive AI agents, and human oversight to enhance breach prevention and SOC modernization.

CrowdStrike introduces agentic MDR and SOC Transformation Services to enhance SOC capabilities with AI and automation, emphasizing data foundations, workflows, and governance for improved detection and response across diverse environments.

CrowdStrike introduces Charlotte AI AgentWorks and Agentic SOAR to enable agentic security operations, leveraging AI and automation to enhance SOC capabilities by orchestrating context-aware agents that can reason across domains and take governed actions.

CrowdStrike's Charlotte AI AgentWorks and Agentic SOAR enable agentic security operations by providing a hub for building and orchestrating AI-powered security agents, reducing manual workloads and accelerating AI adoption with free AI credits.

CrowdStrike's Charlotte AI AgentWorks facilitates the development and deployment of AI-driven security agents within the SOC, aiming to enhance analyst capabilities through automated and orchestrated responses to threats.

An adversary may create or modify an Azure Automation runbook to execute malicious code and maintain persistence in their target's environment, detected through Azure activity logs.

This analytic detects the creation of a new Azure Automation Runbook within an Azure tenant using Azure Audit events, which adversaries with privileged access can abuse to maintain persistence, escalate privileges, or execute malicious code, potentially leading to unauthorized actions and compromise of the Azure environment.

Detect the creation of new Azure Automation accounts, which can be used by attackers for persistence, privilege escalation, and malicious runbook execution within Azure environments.