Apple — CraftedSignal Threat Feed

CUPS Vulnerability Allows Local Privilege Escalation

hello@craftedsignal.io — Thu, 30 Apr 2026 09:43:58 +0000

A vulnerability exists within the Common Unix Printing System (CUPS), a widely used printing system on Linux and macOS. A local attacker can leverage this flaw to execute arbitrary code with elevated, administrator-level privileges. While the specific details of the vulnerability are not provided in this brief, successful exploitation would grant the attacker full control over the affected system. Apple is the primary maintainer of CUPS. Defenders should focus on identifying and mitigating potential exploitation attempts by monitoring for suspicious CUPS-related processes and file modifications.

Attack Chain

The attacker gains initial local access to the target system through legitimate means or by exploiting a separate vulnerability.
The attacker identifies the vulnerable CUPS service running on the system.
The attacker crafts a malicious payload designed to exploit the CUPS vulnerability. This payload could be a specially crafted print job or a manipulated configuration file.
The attacker executes the malicious payload, triggering the vulnerability in CUPS.
Due to the vulnerability, CUPS executes the attacker’s code with administrator privileges.
The attacker uses the elevated privileges to install persistent backdoors, modify system configurations, or escalate privileges further.
The attacker moves laterally within the network or exfiltrates sensitive data.
The final objective is complete system compromise, data theft, or disruption of services.

Impact

Successful exploitation of this CUPS vulnerability allows a local attacker to gain complete control over the affected system. This could lead to data theft, system disruption, or the installation of persistent backdoors. The widespread use of CUPS in Linux and macOS environments makes this a significant threat. If successfully exploited, attackers can achieve complete system compromise and potentially move laterally within the network.

Recommendation

Monitor for suspicious CUPS processes being spawned by unusual parent processes using the CUPS Spawning Suspicious Processes Sigma rule.
Inspect CUPS configuration files for unauthorized modifications using the CUPS Configuration File Modification Sigma rule.
Investigate any unexplained privilege escalation events originating from the CUPS service.

RMM Domain DNS Queries from Non-Browser Processes

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection identifies potentially malicious use of Remote Monitoring and Management (RMM) tools by detecting DNS queries to known RMM domains originating from processes that are not web browsers. Attackers frequently abuse legitimate RMM software for command and control, persistence, and lateral movement within compromised networks. This rule focuses on surfacing RMM clients, scripts, or other non-browser activity contacting these services, thereby increasing the likelihood of detecting unauthorized remote access or malicious activity. The rule aims to reduce false positives by excluding common browser processes and focusing on unusual network activity. The identified domains are associated with various RMM tools like TeamViewer, AnyDesk, and ScreenConnect. This detection is relevant for organizations concerned about insider threats, supply chain attacks, or general compromise leading to unauthorized remote access.

Attack Chain

An attacker gains initial access to a system, possibly through phishing or exploiting a vulnerability.
The attacker installs an unauthorized RMM tool (e.g., using a script or installer).
The RMM tool initiates a DNS query to resolve its command and control domain (e.g., teamviewer.com).
The system, now running the RMM agent, establishes a connection to the attacker-controlled RMM server.
The attacker uses the RMM tool to execute commands on the compromised system.
The attacker uses the RMM tool for lateral movement within the network.
The attacker uses the RMM tool to maintain persistence on the compromised system.

Impact

Compromise via unauthorized RMM tools can provide attackers with persistent remote access, enabling them to perform a range of malicious activities, including data theft, ransomware deployment, and further lateral movement within the network. Successful exploitation can lead to significant financial loss, reputational damage, and disruption of business operations. The number of affected systems can vary depending on the scope of the initial compromise and the attacker’s ability to move laterally.

Recommendation

Deploy the Sigma rule RMM Domain DNS Queries from Non-Browser Processes to your SIEM and tune it to your environment, excluding legitimate non-browser processes that use RMM tools.
Investigate any alerts generated by the rule, focusing on identifying the process making the DNS query and its parent process, as outlined in the rule’s description.
Monitor DNS query logs for queries to the RMM domains listed in the IOC table, and block them at the DNS resolver if unauthorized RMM use is confirmed.
Enable Sysmon Event ID 22 (DNS Query) logging to provide the necessary data for this detection, as recommended in the “Setup” section of the content.

LSASS Loading Suspicious DLL

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

The Local Security Authority Subsystem Service (LSASS) is a critical Windows component that manages security policies and user authentication. Attackers often target LSASS to dump credentials, using techniques like injecting malicious DLLs. This detection focuses on identifying instances where LSASS loads a DLL that is either unsigned or not signed by a trusted vendor. The rule excludes known legitimate signatures and file hashes to reduce false positives. This activity is a strong indicator of credential access attempts, potentially leading to further compromise of the system and network. The signatures identified in the rule contain well-known software vendors like Microsoft, McAfee and Citrix.

Attack Chain

An attacker gains initial access to the system through various means (e.g., phishing, exploiting a vulnerability).
The attacker elevates privileges to gain sufficient access to interact with the LSASS process.
The attacker drops a malicious DLL onto the system, often disguised as a legitimate file.
The attacker injects the malicious DLL into the LSASS process using techniques like Reflective DLL Injection.
LSASS loads the injected DLL, granting the attacker access to sensitive credentials stored in memory.
The malicious DLL dumps credentials, such as plaintext passwords or NTLM hashes.
The attacker uses the stolen credentials for lateral movement to other systems on the network.
The attacker achieves their final objective, such as data exfiltration or deploying ransomware.

Impact

Successful exploitation leads to credential compromise, allowing attackers to move laterally within the network, access sensitive data, and potentially achieve complete domain dominance. This can result in data breaches, financial losses, and reputational damage. The impact depends on the level of access associated with the compromised credentials.

Recommendation

Deploy the LSASS Loading Untrusted DLL Sigma rule to your SIEM to detect suspicious DLLs loaded by LSASS.
Investigate any alerts generated by the Sigma rule and review the loaded DLL’s code signature and hash.
Block the identified SHA256 hashes listed in the IOC table to prevent the execution of known malicious DLLs.
Implement application whitelisting to restrict which DLLs can be loaded into LSASS.
Enable Sysmon process creation and image load logging to provide the necessary data for detection.