Tag
GOLD OGRE: AI-Assisted Intrusion and Aur0ra Ransomware Operations
3 TTPs 3 IOCsThe GOLD OGRE threat group leverages agentic AI frameworks, including Cursor AI and LLMs, to automate post-exploitation tasks, evade EDR, and conduct Aur0ra ransomware attacks.
Local Privilege Escalation Vulnerability in Windows Kernel (CVE-2024-21338)
2 rules 5 TTPs 7 CVEsCVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.
Suspicious Rundll32 Execution with StartW Parameters
1 rule 1 TTPDetection of rundll32.exe executing with 'Start' or 'StartW' function parameters, a common technique used by Cobalt Strike payloads to achieve arbitrary code execution and persistence.
Cobalt Strike Command and Control Beacon Detection
1 rule 2 TTPsAdversaries, notably FIN7, deploy Cobalt Strike beacons on compromised systems to establish command and control (C2) channels, utilizing specific network activity algorithms and domain naming conventions for communication over protocols like HTTP or TLS, posing a critical risk of further compromise and data exfiltration.
KnowledgeDeliver ViewState Deserialization Vulnerability Exploitation
2 rules 4 TTPs 1 CVEAn unauthenticated remote code execution vulnerability, CVE-2026-5426, in Digital Knowledge's KnowledgeDeliver LMS platform due to shared ASP.NET machine keys allows attackers to inject malicious code, ultimately leading to Cobalt Strike infection of user workstations.
Cobalt Strike Command and Control Beacon Detected
2 rules 2 TTPsThis brief documents the detection of Cobalt Strike command and control activity through identifying specific domain naming conventions used by its implant beacons, indicative of network attack and exploitation campaigns.