Skip to content
Threat Feed
Subscribe

Tag

Process-Monitoring

5 briefs RSS
medium advisory

Linux System Network Discovery Reconnaissance

Adversaries perform network reconnaissance on Linux systems by rapidly enumerating network configuration and firewall settings, which this analytic detects via a 30-minute window of process execution telemetry.

linux reconnaissance network-discovery process-monitoring
1r 1t
medium advisory

Detection of Insecure Curl Execution in Kubernetes Clusters

Threat actors may leverage curl with insecure flags within Kubernetes environments to bypass TLS certificate verification, facilitating man-in-the-middle attacks and unauthorized tool ingress.

Isovalent Runtime Security kubernetes cloud-security process-monitoring
1r 1t
medium advisory

Command Line Obfuscation via Whitespace Padding

Detection of command-line obfuscation where attackers insert excessive whitespace sequences to evade signature-based security monitoring tools.

defense-evasion obfuscation process-monitoring
1r 2t
medium advisory

macOS Kernel-to-Userland Process Creation Notification via undocumented kev_msg_post

The kev_msg_post function can be abused by malware to broadcast process creation notifications from a kernel extension (kext) to a user-mode application, potentially bypassing security tools that rely on standard APIs and leading to undetected malicious activity.

BlockBlock kernel-extension kev_msg_post macos process-monitoring
2r
medium advisory

Leveraging Apple's Endpoint Security Framework for Process Monitoring

This brief discusses the use of Apple's Endpoint Security Framework in macOS 10.15 and later for user-mode process monitoring, offering improved capabilities over the older OpenBSM subsystem.

macOS endpoint-security process-monitoring defense-evasion discovery
2r 2t