Tag
praisonai-platform: Cross-Workspace Label IDOR Vulnerability
2 rules 3 TTPsPraison AI's praisonai-platform is vulnerable to an insecure direct object reference (IDOR) in the label endpoints (CVE-2026-47414), allowing cross-workspace label modification and information disclosure due to improper validation of label and issue IDs.
GenAI Tools Accessing Sensitive Files for Credential Access and Persistence
2 rules 4 TTPsThis threat brief details the detection of GenAI tools accessing sensitive files containing credentials, SSH keys, browser data, and shell configurations, indicating potential credential harvesting and persistence attempts by attackers leveraging GenAI agents.
Detection of Sensitive LDAP Attribute Access
2 rules 5 TTPsThis rule detects unauthorized access to sensitive Active Directory object attributes such as unixUserPassword, ms-PKI-AccountCredentials, and msPKI-CredentialRoamingTokens, potentially leading to credential theft and privilege escalation.
Exchange Mailbox Export via PowerShell
2 rules 4 TTPsAdversaries may use the New-MailboxExportRequest PowerShell cmdlet to export mailboxes in Exchange, potentially leading to sensitive information theft.
Detection of Encrypted Archive Creation with WinRAR or 7-Zip
2 rules 2 TTPsAdversaries use WinRAR or 7-Zip with encryption options to compress and protect stolen data before exfiltration, making detection more challenging.
Linux Sensitive File Compression for Credential Access
2 rules 3 TTPsAttackers may use compression utilities like zip, tar, and gzip on Linux systems to collect and archive sensitive files containing credentials and system configurations for credential access and data exfiltration.