Skip to content

Research reports

Vendor, government and researcher reports that CyberSIXT links from its coverage, with their publishers and topics.

1,281 reports398 publishers97 added in the past week

921–940 of 1,281 reports · page 47 of 65

Added Mon 6 Apr

MITRE ATT&CK · Web page · Added 6 Apr
Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - Enterprise
Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.[1] W32Time time providers are responsible for retrieving time stamps from hardware/network…
Original (new tab)
offsec.almond.consulting · Web page · Added 6 Apr
UAC bypass via elevated .NET applications
TL;DR .NET Framework can be made to load a profiling DLL or a COM component DLL via user-defined environment variables and CLSID registry entries, even when the process is elevated. This behavior can be exploited to bypass UAC in default settings on Windows 7…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Boot or Logon Autostart Execution: LSASS Driver, Sub-technique T1547.008 - Enterprise
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the…
Original (new tab)
dl.acm.org · Web page · Added 6 Apr
Rage against the virtual machine
Several features on this page require Premium Access. Information & Contributors Bibliometrics & Citations Reading Options References Figures Tables Media Share Abstract Antivirus companies, mobile application marketplaces, and the security research…
Malware Mobile Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Encrypted Channel, Technique T1573 - Enterprise
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…
State-sponsored Malware Botnets and DDoS Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Patchwork, Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover, Group G0040
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control Patchwork bypassed User Access Control (UAC).[1] Enterprise T1560 Archive Collected Data Patchwork encrypted the collected files' path with AES and then encoded them with…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Behavioral Detection of User Discovery via Local and Remote Enumeration, Detection Strategy DET0093
Adversary launches built-in system tools (e.g., whoami, query user, net user) or scripts that enumerate user account information via local execution or remote API queries (e.g., WMI, PowerShell). Log Sources Data Component Name Channel Process Creation…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server. [3] G1030 Agrius Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[4] G0007 APT28…
State-sponsored Vulnerabilities Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Detection of Remote Access Software, Detection Strategy DET0624
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0624#AN1689
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Command and Scripting Interpreter: AppleScript, Sub-technique T1059.002 - Enterprise
Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.[1] These AppleEvent messages can be sent independently or easily…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Authorization Enforcement, Mitigation M0800 - ICS
Restrict configurations changes and firmware updating abilities to only authorized individuals. ICS T0858 Change Operating Mode All field controllers should restrict operating mode changes to only required authenticated users (e.g., engineers, field…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Event Triggered Execution: LC_LOAD_DYLIB Addition, Sub-technique T1546.006 - Enterprise
Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
System Binary Proxy Execution: Control Panel, Sub-technique T1218.002 - Enterprise
Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Boot or Logon Autostart Execution: Security Support Provider, Sub-technique T1547.005 - Enterprise
Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and…
Original (new tab)
teamviewer.com · Web page · Added 6 Apr
Secure remote access and support
By Neal Silverstein Head of Technology Customer Service at Specsavers 118,115 reviews 3,649 reviews 2,714 reviews 11,513 reviews TeamViewer DEX Essentials means proactive IT Real-time visibility, actionable insights, and automation built for tomorrow.…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Input Capture: GUI Input Capture, Sub-technique T1056.002 - Enterprise
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the…
Original (new tab)
ETDA Threat Group Cards · Web page · Added 6 Apr
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Emdivi Tool: Emdivi Names Emdivi Newsripper Category Malware Type Backdoor Description (Kaspersky) The emdivi family stores important data about itself, including C2, API name, strings for…
Malware Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Behavioral Detection of Obfuscated Files or Information, Detection Strategy DET0378
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation. Log Sources Data Component Name…
Original (new tab)
enigmasoftware.com · Web page · Published 23 Nov
Vad är Msedge.exe?
Vissa Windows-användare kanske märker att en process som heter 'msedge.exe' är aktiv i bakgrunden av deras system. Vanligtvis borde det inte vara något att oroa sig för eftersom just denna process är en del av Microsoft Edge-webbläsaren. Även om applikationen…
Original (new tab)
MITRE ATT&CK · Web page · Added 6 Apr
Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise
ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…
State-sponsored Malware Original (new tab)

Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.