Vendor
Increased npm Supply Chain Attacks Targeting SAP Developers
2 rules 5 TTPs 3 IOCsThreat actors are compromising npm packages, including those targeting SAP developers, to steal credentials, embed themselves in CI/CD pipelines, and deploy multi-stage payloads using techniques like wormable propagation and covert C2 channels on GitHub.
Mini Shai-Hulud Supply Chain Attack Targets SAP NPM Packages
2 rules 1 TTPThe Mini Shai-Hulud campaign injected malicious code into SAP NPM packages, targeting credentials and cloud secrets related to SAP Cloud Application Programming (CAP) and SAP cloud deployment workflows, exfiltrating data through public GitHub repositories.
Compromised SAP npm Packages Steal Developer Credentials
2 rules 5 TTPsMultiple official SAP npm packages were compromised via a supply chain attack, likely by TeamPCP, to steal credentials and authentication tokens from developers' systems.
Detection of Custom Shim Database Installation for Persistence
2 rules 1 TTPAttackers abuse the Application Compatibility Shim functionality in Windows to establish persistence and achieve arbitrary code execution by installing malicious shim databases, which this detection identifies through monitoring registry changes.
Kerberos Traffic from Unusual Process
2 rules 2 TTPsDetects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.