Research reports

MITRE ATT&CK · Web page · Added 6 Apr

ACAD/Medre.A, Software S1000

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S1000

Microsoft · Web page · Added 6 Apr

xp_cmdshell (Transact-SQL) - SQL Server

Spawns a Windows command shell and passes in a string for execution. Any output is returned as rows of text. Transact-SQL syntax conventions xp_cmdshell { 'command_string' } [ , NO_OUTPUT ] Important Arguments for extended stored procedures must be entered in…

MITRE ATT&CK · Web page · Added 6 Apr

Automated File and API Collection Detection Across Platforms, Detection Strategy DET0186

Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection…

MITRE ATT&CK · Web page · Added 6 Apr

Detecting Remote Script Proxy Execution via PubPrn.vbs, Detection Strategy DET0528

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0528

MITRE ATT&CK · Web page · Added 6 Apr

Detection of Compromise Software Supply Chain, Detection Strategy DET0721

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0721

Mandiant (Google) · Web page · Published 7 Jun

A Totally Tubular Treatise on TRITON and TriStation

In December 2017, FireEye's Mandiant discussed an incident response involving the TRITON framework. The TRITON attack and many of the publicly discussed ICS intrusions involved routine techniques where the threat actors used only what is necessary to succeed…

MITRE ATT&CK · Web page · Added 6 Apr

SIP and Trust Provider Hijacking Mitigation, Mitigation T1198 - Enterprise

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/mitigations/T1198

MITRE ATT&CK · Web page · Added 6 Apr

Prikormka, Software S0113

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.[1] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Prikormka adds itself to a Registry Run…

MITRE ATT&CK · Web page · Added 6 Apr

Tarrask, Software S1011

Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/software/S1011

deepinstinct.com · Web page · Published 2 Apr

New ServHelper Variant Employs Excel 4.0 Macro to drop Singed Payload

ServHelper is a recently discovered backdoor associated with TA505. A veteran threat group that has also been associated with the infamous Dridex banking malware, the GlobeIimposter ransomware, and other high-profile malware campaigns. Deep Instinct Threat…

Trend Micro · Web page · Added 6 Apr

trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt

Krebs on Security · Web page · Published 18 Nov

Be Very Sparing in Allowing Site Notifications

An increasing number of websites are asking visitors to approve “notifications,” browser modifications that periodically display messages on the user’s mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying…

MITRE ATT&CK · Web page · Added 6 Apr

Detection of Impair Defenses through Disabled or Modified Tools across OS Platforms., Detection Strategy DET0497

Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry…

guidepointsecurity.com · Web page · Published 22 Apr

Mount Locker Ransomware Steps up Counter-IR Capabilities, Hindering Efforts for Detection, Response and Investigation

Over the past six weeks, GuidePoint Security threat researchers have noted a change in the tactics used by Mount Locker ransomware seen in recent engagements. Mount Locker group first announced their ransomware-as-a-service offering in the second half of…

MITRE ATT&CK · Web page · Added 5 Apr

Detection Strategy for VBA Stomping, Detection Strategy DET0012

Discrepancies between VBA source code and p-code inside Office documents. Defender perspective: anomalies in file metadata streams, execution of Office processes loading macros without source code consistency, and script execution with no corresponding source…

ETDA Threat Group Cards · Web page · Added 5 Apr

Threat Group Cards: A Threat Actor Encyclopedia

Home > List all groups > List all tools > List all groups using tool Karkoff Tool: Karkoff Names Karkoff MailDropper DropperBackdoor CACTUSPIPE OILYFACE Category Malware Type Backdoor, Dropper Description (Talos) In April, Cisco Talos identified an…

sygnia.co · Web page · Published 1 Jul

Luna Moth Ransomware: The Threat Actors Behind Recent False Subscription Scams

Sygnia’s team identified ‘Luna Moth’ ransom group. The threat actors resemble false subscription scammers, focusing on corporate data theft. Oren Biderman, Tomer Lahiyani, Noam Lifshitz, Ori Porag 1 July 2022 8 min Over the last few months, Sygnia’s Incident…

contagiodump.blogspot.com · Web page · Added 5 Apr

contagio

Contagio is a collection of the historic malware samples, threats, observations, and analyses. Malware samples are available for download by any responsible whitehat researcher. By downloading the samples, anyone waives all rights to claim punitive,…

Trend Micro · Web page · Added 5 Apr

Research, News, and Perspectives

Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads A packaging error in Anthropic’s Claude Code npm release briefly exposed internal source code. This entry examines how threat actors rapidly weaponized the resulting attention, pivoting…

prevailion.com · Web page · Published 5 Jun

Prevailion Blog

Prevailion’s Tailored Intelligence Team has detected two new criminal campaigns targeting the global financial industry with the EVILNUM malware, one of which became active on May 3rd 2020. We have dubbed these new operations “Phantom in the [Command] Shell”.…