Skip to content
Threat Feed
Subscribe

Tag

Security_controls

3 briefs RSS
medium advisory

GitHub Organizations 2FA Disabled

The disabling of two-factor authentication (2FA) in GitHub Organizations is detected through audit log monitoring, potentially indicating an attacker's attempt to weaken account security and facilitate unauthorized access.

github.com +3 github 2fa security_controls supply_chain
3r 3t
high advisory

Detection of PowerShell Execution Policy Changes to Unrestricted or Bypass

Detection of modifications to the PowerShell execution policy to 'Unrestricted' or use of the 'Bypass' flag indicates a potential attempt to execute unsigned or malicious scripts, bypassing security controls.

PowerShell execution_policy bypass security_controls
2r 1t
high advisory

ESXi Lockdown Mode Disabled

The disabling of Lockdown Mode on an ESXi host may indicate a threat actor attempting to weaken host security controls to enable broader remote access for data exfiltration, lateral movement, or VM tampering.

ESXi +3 vmware lockdown_mode security_controls
2r