CyberSIXT Search

Research reports

1,224 reports from 387 publishers45 added in the past week

44 reports, newest added first

MITRE ATT&CKAdded in the past yearClear

Added Mon 6 Apr

  1. Detection of Exploitation of Remote Services, Detection Strategy DET0663

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0663#AN1756

    Vulnerabilities

    MITRE ATT&CK

  2. Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205, Detection Strategy DET0524

    A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket,…

    MITRE ATT&CK

  3. APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073

    APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…

    State-sponsoredMalware

    MITRE ATT&CK

  4. Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi, Detection Strategy DET0124

    Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads…

    MITRE ATT&CK

  5. Detection Strategy for Overwritten Process Arguments Masquerading, Detection Strategy DET0164

    Detects adversary behavior where the command-line arguments of a running process are overwritten in memory to spoof the process name, typically replacing it with a benign or misleading string. The detection correlates unexpected null byte sequences,…

    MITRE ATT&CK

  6. Detection Strategy for T1542.001 Pre-OS Boot: System Firmware, Detection Strategy DET0099

    Unexpected write operations to BIOS/UEFI firmware regions or EFI boot partitions that do not correlate with legitimate vendor firmware updates. API calls or utilities such as fwupdate.exe or vendor flash tools executed from non-administrative or non-IT…

    MITRE ATT&CK

  7. Detection of Cloud Accounts, Detection Strategy DET0879

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0879#AN2011

    MITRE ATT&CK

  8. LockBit 3.0, Software S1202

    Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.[3] Enterprise T1071 .001 Application Layer…

    Ransomware

    MITRE ATT&CK

  9. Execution, Tactic TA0041 - Mobile

    The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a mobile device. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader…

    Mobile

    MITRE ATT&CK

  10. Adversary-in-the-Middle: Evil Twin, Sub-technique T1557.004 - Enterprise

    Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. [1] By using a Service Set…

    MITRE ATT&CK

  11. ACAD/Medre.A, Software S1000

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S1000

    MITRE ATT&CK

  12. Automated File and API Collection Detection Across Platforms, Detection Strategy DET0186

    Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection…

    MITRE ATT&CK

  13. Detecting Remote Script Proxy Execution via PubPrn.vbs, Detection Strategy DET0528

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0528

    MITRE ATT&CK

  14. Detection of Compromise Software Supply Chain, Detection Strategy DET0721

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0721

    Supply chain

    MITRE ATT&CK

  15. SIP and Trust Provider Hijacking Mitigation, Mitigation T1198 - Enterprise

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/mitigations/T1198

    MITRE ATT&CK

  16. Prikormka, Software S0113

    After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.[1] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Prikormka adds itself to a Registry Run…

    MITRE ATT&CK

  17. Tarrask, Software S1011

    Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S1011

    MITRE ATT&CK

  18. Detection of Impair Defenses through Disabled or Modified Tools across OS Platforms., Detection Strategy DET0497

    Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry…

    MITRE ATT&CK

Added Sun 5 Apr

  1. Detection Strategy for VBA Stomping, Detection Strategy DET0012

    Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source…

    MITRE ATT&CK

  2. Detection of Local Data Staging Prior to Exfiltration, Detection Strategy DET0261

    Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior. Log Sources Mutable Elements Field Description StagingDirList Paths such as C:\Temp, C:\Windows\Tasks,…

    MITRE ATT&CK

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device