Skip to content
Threat Feed
Subscribe

Tag

Lotl

4 briefs RSS
medium advisory

Unauthorized Command Execution via Self-Hosted GitHub Actions Runners

Adversaries gaining unauthorized workflow trigger access can abuse GitHub Actions runners to execute arbitrary system commands, potentially leading to credential harvesting, reconnaissance, and CI/CD supply chain compromise.

GitHub Actions +1 execution supply-chain ci-cd lotl
1r 1t updated
high advisory

Suspicious Reconnaissance Activity via GatherNetworkInfo.VBS

Adversaries are utilizing the native Windows script GatherNetworkInfo.vbs to perform system reconnaissance and collect network configuration data.

reconnaissance discovery lotl living-off-the-land windows-scripting
1r 2t
high advisory

Abuse of Esentutl.exe for Sensitive Credential File Extraction

Adversaries are leveraging the legitimate Windows binary 'esentutl.exe' to bypass file locks and perform unauthorized copies of system credential databases such as NTDS.dit and SAM.

credential-access lotl windows-security
1r 1t
high advisory

Bad Apples: Weaponizing Native macOS Primitives for Lateral Movement and Execution

Adversaries are increasingly targeting macOS environments, leveraging native tools like Remote Application Scripting (RAS) and Spotlight metadata to bypass security controls for remote code execution and lateral movement.

macos lotl lateral-movement execution
2r 2t