Threat Research

Identifies Certipy execution, a tool used for enumerating and exploiting Active Directory Certificate Services by analyzing PE metadata characteristics and typical command line parameters....

"Disable Windows Defender Functionalities Via Registry Keys" involves altering specific registry settings to turn off or limit the capabilities of Windows Defender, Microsoft's built-in antivirus software. This technique is often employed by malware to evade detection and maintain persistence on an infected system....

"LSASS Process Memory Dump Files" refer to the memory dumps created from the Local Security Authority Subsystem Service (LSASS) process in Windows. LSASS is responsible for enforcing security policies, managing user logins, and handling password verification....

Identifies when Microsoft Excel is loading an Add-In (.xll) file....

"Ursnif Redirection of Discovery Commands" refers to a technique used by the Ursnif malware to manipulate network traffic and redirect system discovery commands. Ursnif, a banking trojan, can intercept and alter commands sent from legitimate applications to gather sensitive information or execute malicious actions....

The "Potential SNAKE Malware Installation Binary Indicator" refers to specific signs or files that may signal the presence of SNAKE malware on a system. SNAKE, also known as Ekans, is a type of ransomware that targets industrial control systems....

The article "No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection" reveals four previously undisclosed DNS tunneling campaigns identified through a new monitoring system. This system detects potentially malicious tunneling domains by analyzing patterns and attributes associated with past campaigns....

Identifies potential searches for JWT tokens in the CLI by scanning for the strings "eyJ0eX" or "eyJhbG." These strings serve as markers to locate the beginning of JWT tokens used by Microsoft Office and similar applications....

Identifies possible DLL sideloading involving Python DLL files....

"SmartLoader to Lumma Stealer" refers to a transition in malware distribution techniques, where SmartLoader, a versatile malware delivery platform, is used to deploy Lumma Stealer. Lumma Stealer is designed to harvest sensitive information, such as login credentials, payment details, and personal data, from infected systems....

Proofpoint researchers discovered a campaign impersonating the British postal service, Royal Mail, to deliver Prince ransomware. This ransomware variant is available for free on GitHub, accompanied by a "disclaimer" stating it is intended solely for educational purposes. The campaign took place in mid-September, targeting individuals in the UK and the U.S....

"Suspicious Chromium Browser Instance Executed With Custom Extension" typically refers to security concerns surrounding a Chromium-based browser running with a potentially malicious or unauthorized extension. This situation can indicate that the browser instance may be used for activities like data theft, phishing, or unauthorized access to user information....

Initial phishing attempts involved Ukrainian-language emails sent on October 1, 2024, themed around "payment orders," with a common attached PDF. Three examples were found on VirusTotal; two targeted .gov.ua recipients and one was sent to a US-based university....

Researchers at Palo Alto Networks identified an automated scanning tool called Swiss Army Suite (S.A.S) during routine telemetry monitoring. This tool was used by attackers to conduct vulnerability scans on both customer web services and various online sites....

Identifies the execution of PowerShell commands that reference classes from the "System.Security.Cryptography" namespace. This namespace offers classes for real-time encryption and decryption, which can be used, for instance, to decrypt malicious payloads for evading detection....