Research reports

Microsoft · Web page · Added 6 Apr

Set up Recovery Actions to Take Place When a Service Fails

Applies To: Windows 7, Windows 8, Windows Server 2008 R2, Windows Server 2012 If a service fails, you can use the Services snap-in to specify what action to take (for example, running a program or script) on the first or second service failure, or on…

Netskope · Web page · Published 10 Aug

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)

This blog series expands upon a presentation given at DEF CON 29 on August 7, 2021. Phishing attacks are starting to evolve from the old-school faking of login pages that harvest passwords to attacks that abuse widely-used identity systems such as Microsoft…

MITRE ATT&CK · Web page · Added 6 Apr

Adversary-in-the-Middle: Evil Twin, Sub-technique T1557.004 - Enterprise

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. [1] By using a Service Set…

MITRE ATT&CK · Web page · Added 6 Apr

ACAD/Medre.A, Software S1000

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S1000

Microsoft · Web page · Added 6 Apr

xp_cmdshell (Transact-SQL) - SQL Server

Spawns a Windows command shell and passes in a string for execution. Any output is returned as rows of text. Transact-SQL syntax conventions xp_cmdshell { 'command_string' } [ , NO_OUTPUT ] Important Arguments for extended stored procedures must be entered in…

MITRE ATT&CK · Web page · Added 6 Apr

Automated File and API Collection Detection Across Platforms, Detection Strategy DET0186

Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection…

MITRE ATT&CK · Web page · Added 6 Apr

Detecting Remote Script Proxy Execution via PubPrn.vbs, Detection Strategy DET0528

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0528

MITRE ATT&CK · Web page · Added 6 Apr

Detection of Compromise Software Supply Chain, Detection Strategy DET0721

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0721

Mandiant (Google) · Web page · Published 7 Jun

A Totally Tubular Treatise on TRITON and TriStation

In December 2017, FireEye's Mandiant discussed an incident response involving the TRITON framework. The TRITON attack and many of the publicly discussed ICS intrusions involved routine techniques where the threat actors used only what is necessary to succeed…

MITRE ATT&CK · Web page · Added 6 Apr

SIP and Trust Provider Hijacking Mitigation, Mitigation T1198 - Enterprise

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/mitigations/T1198

MITRE ATT&CK · Web page · Added 6 Apr

Prikormka, Software S0113

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.[1] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Prikormka adds itself to a Registry Run…

MITRE ATT&CK · Web page · Added 6 Apr

Tarrask, Software S1011

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S1011

deepinstinct.com · Web page · Published 2 Apr

New ServHelper Variant Employs Excel 4.0 Macro to drop Singed Payload

ServHelper is a recently discovered backdoor associated with TA505. A veteran threat group that has also been associated with the infamous Dridex banking malware, the GlobeIimposter ransomware, and other high-profile malware campaigns. Deep Instinct Threat…

Trend Micro · Web page · Added 6 Apr

trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt

Krebs on Security · Web page · Published 18 Nov

Be Very Sparing in Allowing Site Notifications

An increasing number of websites are asking visitors to approve “notifications,” browser modifications that periodically display messages on the user’s mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying…

MITRE ATT&CK · Web page · Added 6 Apr

Detection of Impair Defenses through Disabled or Modified Tools across OS Platforms., Detection Strategy DET0497

Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry…

guidepointsecurity.com · Web page · Published 22 Apr

Mount Locker Ransomware Steps up Counter-IR Capabilities, Hindering Efforts for Detection, Response and Investigation

Over the past six weeks, GuidePoint Security threat researchers have noted a change in the tactics used by Mount Locker ransomware seen in recent engagements. Mount Locker group first announced their ransomware-as-a-service offering in the second half of…

MITRE ATT&CK · Web page · Added 5 Apr

Detection Strategy for VBA Stomping, Detection Strategy DET0012

Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source…

ETDA Threat Group Cards · Web page · Added 5 Apr

Threat Group Cards: A Threat Actor Encyclopedia

Home > List all groups > List all tools > List all groups using tool Karkoff Tool: Karkoff Names Karkoff MailDropper DropperBackdoor CACTUSPIPE OILYFACE Category Malware Type Backdoor, Dropper Description (Talos) In April, Cisco Talos identified an…

sygnia.co · Web page · Published 1 Jul

Luna Moth Ransomware: The Threat Actors Behind Recent False Subscription Scams

Sygnia’s team identified ‘Luna Moth’ ransom group. The threat actors resemble false subscription scammers, focusing on corporate data theft. Oren Biderman, Tomer Lahiyani, Noam Lifshitz, Ori Porag 1 July 2022 8 min Over the last few months, Sygnia’s Incident…