Vendor
Trend Micro Apex One: Multiple Vulnerabilities
2 rules 2 TTPsMultiple vulnerabilities in Trend Micro Apex One could allow an attacker to execute arbitrary code and escalate privileges on affected systems.
Trend Micro Security Advisory Addressing Apex One and Vision One Vulnerabilities
2 rulesTrend Micro released a security advisory addressing vulnerabilities in Apex One (on-premise), Apex One as a service, and Trend Vision One Endpoint, prompting users to apply necessary updates to mitigate potential risks.
Multiple Vulnerabilities in Trend Micro Products Including TrendAI Apex One
2 rules 1 TTP 1 IOCMultiple vulnerabilities exist in Trend Micro products, including TrendAI Apex One, potentially allowing authenticated attackers to tamper with files, distribute malicious code, or escalate privileges; CVE-2026-34926 is being actively exploited.
EvilTokens PhaaS Platform Leverages AI for Device Code Phishing Attacks
2 rules 2 TTPs 2 IOCsThe EvilTokens phishing-as-a-service (PhaaS) platform sold on Telegram is capable of launching device code phishing attacks at scale, leveraging AI to generate convincing and personalized lures, enabling aspiring cybercriminals to bypass traditional security measures, including MFA.
Potential Evasion via Windows Filtering Platform Blocking Security Software
2 rules 2 TTPsAdversaries may add malicious Windows Filtering Platform (WFP) rules to prevent endpoint security solutions from sending telemetry data, impairing defenses, which this rule detects by identifying multiple WFP block events where the process name is associated with endpoint security software.
Suspicious Registry Hive Access via RegBack
2 rules 1 TTPThis rule detects attempts to access registry backup hives (SAM, SECURITY, SYSTEM) via RegBack on Windows systems, which can contain or enable access to credential material.
Windows Defender Disabled via Registry Modification
2 rules 3 TTPsAttackers modify the Windows Defender registry settings to disable the service or set the service to be started manually, evading defenses.
PowerShell Script Block Logging Disabled via Registry Modification
2 rules 2 TTPsAttackers may disable PowerShell Script Block Logging by modifying the registry to conceal their activities on the host and evade detection by setting the `EnableScriptBlockLogging` registry value to 0, impacting security monitoring and incident response capabilities.
Third-party Backup Files Deleted via Unexpected Process
2 rules 2 TTPsThis detection identifies the deletion of backup files by processes outside of the backup suite, specifically targeting Veritas and Veeam backups, which may indicate an attempt to prevent recovery from ransomware.
Suspicious Module Loaded by LSASS for Credential Access
2 rules 2 TTPsDetection of unsigned or untrusted DLLs being loaded into the LSASS process, which is indicative of credential access attempts by adversaries aiming to steal sensitive information such as user passwords.
Windows Filtering Platform Policy Added to Block EDR Process
2 rules 1 TTPAttackers modify the Windows Filtering Platform (WFP) policy to block the communication of endpoint detection and response (EDR) processes, impairing their functionality and hindering detection of malicious activities.
Microsoft Defender Tampering via Registry Modification
2 rules 2 TTPsAdversaries may disable or tamper with Microsoft Defender features via registry modifications to evade detection and conceal malicious behavior on Windows systems.
AppLocker Registry Modification to Deny Security Software Execution
2 rulesAttackers can modify the Windows registry via AppLocker to block the execution of security software, potentially disabling defenses and allowing further malicious activities.
LSASS Loading Suspicious DLL
2 rules 2 TTPs 9 IOCsDetection of LSASS loading an unsigned or untrusted DLL, which can indicate credential access attempts by malicious actors targeting sensitive information stored in the LSASS process.