Skip to content
Threat Feed
Subscribe

Tag

Network-Monitoring

4 briefs RSS
medium advisory

Script Interpreter Initiating Local Network Connections

Detection of suspicious network activity where Windows script interpreters (Wscript.exe and Cscript.exe) initiate connections to local IP ranges.

windows living-off-the-land network-monitoring
1r 1t
high advisory

Outbound RDP Connections Initiated by Non-Standard Processes

Detection of RDP traffic (TCP 3389) initiated by unauthorized or non-standard binaries, which may indicate lateral movement or unauthorized remote access.

lateral-movement network-monitoring windows rdp
1r 1t
medium advisory

Detection of DNS Rebinding via Public-to-Private Resolution Patterns

Attackers leverage DNS rebinding to bypass security boundaries by causing a public domain to resolve to internal, loopback, or private IP addresses, enabling unauthorized access to protected internal services.

initial-access dns-security network-monitoring threat-detection
1t
high threat

CVE-2026-38968: ntopng Predictable Session Identifier Vulnerability Leading to Session Hijacking

CVE-2026-38968 affects ntopng versions up to 6.6, enabling session hijacking through predictable session identifiers generated with weak time-seeded pseudo-randomness in `src/HTTPserver.cpp`, allowing attackers to gain unauthorized access to legitimate user sessions.

exploited ntopng through 6.6 session-hijacking vulnerability ntopng network-monitoring
1c