Skip to content
Threat Feed
Subscribe

Vendor

Malwarebytes

4 briefs RSS
medium advisory

Potential Evasion via Windows Filtering Platform Blocking Security Software

Adversaries may add malicious Windows Filtering Platform (WFP) rules to prevent endpoint security solutions from sending telemetry data, impairing defenses, which this rule detects by identifying multiple WFP block events where the process name is associated with endpoint security software.

Windows Filtering Platform +2 defense-evasion windows-filtering-platform endpoint-security
2r 2t
high threat

Mac Malware of 2019 Report

The Mac Malware of 2019 report details various Mac malware specimens and variants, including CookieMiner, a cryptominer that steals user cookies and passwords, likely to give attackers access to victims' online accounts and wallets; CookieMiner persists via launch agents and exfiltrates browser cookies to a remote C2 server.

CleanMy Mac X +1 Lazarus Group +4 macos malware cryptominer cookie-stealing
2r 3t 2i
high advisory

Suspicious Process Access via Direct System Call

Detects suspicious process access events where the call trace does not originate from known Windows system DLLs, indicating potential defense evasion by bypassing hooked APIs via direct syscalls.

EdgeWebView +4 defense-evasion execution windows
2r 3t
high advisory

AppLocker Registry Modification to Deny Security Software Execution

Attackers can modify the Windows registry via AppLocker to block the execution of security software, potentially disabling defenses and allowing further malicious activities.

Splunk Enterprise +2 applocker defense-evasion registry-modification
2r