Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,233 reports388 publishers50 added in the past week

881–900 of 1,024 reports · page 45 of 52 · Clear filters

Added Mon 6 Apr

MITRE ATT&CK · Web page · Added 6 Apr
Detection of Remote Access Software, Detection Strategy DET0624
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0624#AN1689
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Command and Scripting Interpreter: AppleScript, Sub-technique T1059.002 - Enterprise
Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.[1] These AppleEvent messages can be sent independently or easily…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Authorization Enforcement, Mitigation M0800 - ICS
Restrict configurations changes and firmware updating abilities to only authorized individuals. ICS T0858 Change Operating Mode All field controllers should restrict operating mode changes to only required authenticated users (e.g., engineers, field…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Event Triggered Execution: LC_LOAD_DYLIB Addition, Sub-technique T1546.006 - Enterprise
Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
System Binary Proxy Execution: Control Panel, Sub-technique T1218.002 - Enterprise
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Boot or Logon Autostart Execution: Security Support Provider, Sub-technique T1547.005 - Enterprise
Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and…
Original (new tab)
teamviewer.com · Web page · Added 6 Apr
Secure remote access and support
By Neal Silverstein Head of Technology Customer Service at Specsavers 118,115 reviews 3,649 reviews 2,714 reviews 11,513 reviews TeamViewer DEX Essentials means proactive IT Real-time visibility, actionable insights, and automation built for tomorrow.…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Input Capture: GUI Input Capture, Sub-technique T1056.002 - Enterprise
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the…
Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Emdivi Tool: Emdivi Names Emdivi Newsripper Category Malware Type Backdoor Description (Kaspersky) The emdivi family stores important data about itself, including C2, API name, strings for…
Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Behavioral Detection of Obfuscated Files or Information, Detection Strategy DET0378
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation. Log Sources Data Component Name…
Original (new tab)
enigmasoftware.com · Web page · Published 23 Nov
Vad är Msedge.exe?
Vissa Windows-användare kanske märker att en process som heter 'msedge.exe' är aktiv i bakgrunden av deras system. Vanligtvis borde det inte vara något att oroa sig för eftersom just denna process är en del av Microsoft Edge-webbläsaren. Även om applikationen…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…
State-sponsored Malware Original (new tab)
Wikipedia · Web page · Published 21 Apr
Cutwail botnet
The Cutwail botnet, founded around 2007,[1] is a botnet mostly involved in sending spam e-mails. The bot is typically installed on infected machines by a Trojan component called Pushdo. [2] It affects computers running Microsoft Windows. [3] In June 2009 it…
Botnets and DDoS Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Download this tool card in JSON format All groups using tool Jumpall Changed Name Country Observed APT groups APT 17, Deputy Dog, Elderwood, Sneaky Panda 2009-Jun 2024 APT 41 2012-Jul 2025 2 groups liste
State-sponsored Malware Original (new tab)
Dark Reading · Web page · Published 17 Jun
CrowdStrike Falcon Traces Attacks Back To Hackers
Who's launching online attacks against your network? How can you better detect those attacks and -- if an attack turns out to be successful -- identify what was stolen? Enabling businesses to answer those questions is the premise of a cloud-based service…
Original (new tab)
Malpedia · Web page · Added 6 Apr
Croxloader (Malware Family)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader
Malware Original (new tab)
JPCERT/CC · Web page · Published 5 Mar
Malware “TSCookie”
Around 17 January 2018, there were some reports on the social media about malicious emails purporting to be from Ministry of Education, Culture, Sports, Science and Technology of Japan [1]. This email contains a URL leading to a malware called “TSCookie”.…
Malware Original (new tab)
objective-see.com · Web page · Added 6 Apr
OSX.EvilQuest Uncovered
Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve added the sample (‘OSX.EvilQuest’) to our malware collection (password: infect3d) …please don’t infect yourself! Background In part one…
Ransomware Malware Original (new tab)
nzyme.org · Web page · Added 6 Apr
Network Monitoring
What is Network Monitoring? Nzyme works to protect your WiFi networks by consistently comparing the expected state of access points with the observed reality. For instance, if you configure nzyme with a list of all your access points, the activation of an…
Original (new tab)
arstechnica.com · Web page · Published 16 Nov
Meet PoisonTap, the $5 tool that ransacks password-protected computers
The perils of leaving computers unattended is about to get worse. Credit: Samy Kamkar Credit: Samy Kamkar The perils of leaving computers unattended just got worse, thanks to a newly released exploit tool that takes only 30 seconds to install a…
Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.