61 results for “Defender”

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

Microsoft's analysis of the LiteLLM 1.107.0 compromise, published to PyPI and container images on 21 October 2026. The wheel shipped cook.pth, cook.py and sitecustomize.py, so a credential collector (PRIVCOLLECT) ran whenever Python started, even without importing LiteLLM. It covers AES/RSA-encrypted exfiltration to litellm.dev, a re-armable Unix loader, Defender KQL hunting queries, ATT&CK mapping and rotation guidance.

microsoft.comwriteupPublished and added 23 Oct 2026🛡️ Security

Microsoft Threat Intelligence report on Storm-0940, a China-state aligned actor that used the open-source agentic AI pentest framework ARTEX from September 2026 to automate attacks on hundreds of organizations. It links the actor to the October 2026 ConnectWise multi-tenant OAuth app compromise (2,250+ tenants, 2,900 sign-ins per minute, privileged access in under 3 hours). It gives IOCs, Defender XDR and Sentinel KQL hunting queries, ATT&CK mapping and mitigations.

microsoft.comwriteupPublished and added 21 Oct 2026🛡️ Security

Huntress analyzes an October incident where an admin searching Bing for a WatchGuard VPN download landed on watchguard-vpn[.]net, a lookalike site whose popup.js harvests Server/Login/Password, deliberately rejects the first submission to get a second set, and posts to watchguard-ssl[.]online. Unlike earlier iterations (Secplicity, Microsoft Storm-2561), the final payload is the genuine, validly signed WatchGuard installer from the official CDN, so no malware is present for endpoint tools to flag. Covers infrastructure timeline, thin VirusTotal detections, and defender guidance (MFA, monitoring VPN logins from hosting ASNs, blocking domains, publishing official download links).

huntress.comwriteupAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Huntress researchers reconstruct an Akira ransomware attack timeline using forensic artifacts collected after the Huntress agent was installed post-compromise, including Windows Registry Shellbags, Event Logs, and Akira ransomware log files. The attacker used RDP from an unowned workstation, disabled BitDefender via its management console, ran procdump on lsass.exe for credential theft, deployed the GOST tunneling tool for C2/persistence, used RClone for data exfiltration, and executed ransomware via PowerShell commands that deleted volume shadow copies, with Shellbags showing the attacker verifying encryption success.

huntress.comwriteupPublished and added 6 Oct 2026🛡️ Security

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

socket.devwriteupPublished and added 2 Oct 2026🛡️ Security

Huntress breaks down how Microsoft Defender Antivirus (MDAV) path/extension exclusions can be abused to hide malicious binaries from scans, detailing the registry internals (HKLM...Windows Defender\Exclusions vs the GPO-driven Policies key) and the four ways to set them: PowerShell (Set/Add-MpPreference), the MSFT_MpPreference WMI class, GPO, and direct registry edits. It documents real-world abuse by GootKit (2019), WhisperGate (2022), and Muddled Libra (2024), plus an under-documented trick where setting HideExclusionsFromLocalAdmins blocks even SYSTEM from querying exclusions via PowerShell/WMI, and describes the registry-level telemetry and detections Huntress built to catch both behaviors.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Threat Intelligence tracked in-the-wild exploitation of CVE-2026-73570, an unauthenticated OS command-injection vulnerability in Zimbra Collaboration Suite's SNMP notification path (swatchdog-to-snmptrap), triggerable via a crafted SMTP request when the optional zimbra-snmp package is enabled. The post documents pre-disclosure scanning, JSP webshell deployment, a novel pam_exec/zmmailboxdmgr privilege-escalation chain to root, systemd-based persistence (zimlog.service), theft of zimbraPreAuthKey/zimbraAuthTokenKey via zmlocalconfig and LDAP, lateral movement over Zimbra's SSH identity, a multi-stage Go-based remote-access agent (zimclient2 via zimdown2/agent2.sh), a dedicated mailbox-exfiltration implant, and an AzCopy-based exfiltration attempt, closing with Defender XDR KQL hunting queries and MITRE ATT&CK mapping.

microsoft.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Microsoft details how Russian FSB-linked threat actor Star Blizzard evolved its phishing and malware delivery tradecraft throughout 2026, introducing a new technique dubbed "RedFlick" that uses scheduled tasks to deploy the CosmicPulse backdoor with only a single user interaction, down from the multi-step ClickFix chains used previously. The report covers the shift from targeted spear-phishing to large-scale phishing campaigns using accounts on compromised WordPress/CPanel websites, delivery chain variants (VHDX files, Control Panel applet (CPL) masquerading, steganography, PDF-embedded payloads), and the related DarkSword iOS backdoor, affecting 100+ organizations tied to Ukraine support. It includes IOCs, KQL hunting queries for Microsoft Defender/Sentinel, and mitigation guidance.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Microsoft Threat Intelligence documents NeedyMantis, a previously unreported modular post-compromise malware family used in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors. The writeup details a multi-stage C++/x64 shellcode loader chain delivered via DLL sideloading (abusing Poedit, curl, TightVNC, Vim, and spoofed Office/Broadcom/Intel/NVIDIA DLLs), a custom encrypted/compressed archive format, a minimized custom PE-like executable format, and a WebSockets-based C2 protocol with RC4 key exchange and modular load/unload commands. Microsoft links observed use to Storm-3069 (tied to the Kaspersky-reported DAEMON Tools supply chain compromise) and China-nexus activity, and provides IOCs, Defender detections, and KQL/Sentinel hunting queries.

microsoft.comwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

Huntress SOC analyzes an intrusion that began with exploitation of Samsung MagicINFO (CVE-2025-4632, after incomplete fix of CVE-2024-7399) via tomcat9.exe. The actor took three tries to install AnyDesk (certutil and PowerShell attempts were blocked by Defender), created an 'oldadministrator' account, disabled Defender, then ran Silent XMR Miner Builder, which compiled a Monero miner on the endpoint using csc.exe, cvtres.exe, donut, tcc and MinGW gcc. The miner ran masquerading as explorer.exe against C3Pool; the post gives command lines and detection ideas such as unusual compiler child processes from an unsigned parent and explorer.exe with mining arguments.

huntress.comwriteupPublished and added 24 Sep 2026🛡️ Security

Group-IB documents previously undocumented samples of HEAVYGRAM, a Python/PyInstaller-based Windows backdoor that uses the Telegram bot API for command-and-control, screen/audio capture, data exfiltration, and DLL side-loading, alongside the related CRUDEEXCLUDE loader that adds Windows Defender exclusions. The research corroborates and extends a March 2026 US DOJ affidavit and FBI FLASH report, attributing the malware with moderate confidence to the Handala Hack persona — assessed as a false-flag "hacktivist" front for Void Manticore (aka Storm-0842/Banished Kitten), operating on behalf of Iran's MOIS — used since Fall 2023 against Iranian dissidents, journalists, and critics of the Iranian government via Telegram-delivered, Delphi-packaged lures (fake KeePass, Telegram, Pictory apps). It details four infection-chain variants (WSF/VBS downloaders, HTA Telegram-polling scripts, Delphi droppers with embedded archives), the implant's command prefixes (@@/**/##) and attachment handlers, dual-bot C2 configurations, and provides IOCs and detection/hardening recommendations.

group-ib.comwriteupAdded 1 Oct 2026, published 17 Sep 2026🛡️ Security

Socket's Threat Research team identified six malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker, GhostApe, GhostApe Color) that steal authenticated session tokens, Firebase access tokens, and wallet-related data from users of the Axiom Trade and Padre crypto trading platforms. The extensions abuse a byte-identical collection module (axiom-fetch-intercept.js) that reads localStorage/IndexedDB and exfiltrates data by encoding it into URLs opened via browser navigation to Vercel-hosted C2 endpoints, evading manifest-based host-permission review since navigation isn't subject to CORS/CSP connect-src restrictions. The report includes full IOCs (extension IDs, C2 domains, hashes), attribution links via shared code and publisher portfolios, and defender guidance for hunting and blocking the campaign.

socket.devwriteupPublished and added 12 Sep 2026🛡️ Security

A DFIR field notes post describing how an analyst pivoted from a Microsoft Defender "Behavior:Win32/RegDump.SA" alert (flagged on svchost.exe running as SYSTEM) to identify Impacket's secretsdump.py activity. MFT analysis revealed a leftover temp file (ASOWCIKI.tmp) matching Impacket's RemoteOperations naming pattern (8 random ASCII chars + .tmp) for a partially-saved SAM registry hive, and the post explains why svchost.exe appears in telemetry due to the Remote Registry service being abused over MS-RRP/winreg via SMB. It also cross-references a similar Huntress case (April 2026) that additionally observed SCM Event ID 7040 (Remote Registry service enabled) as a corroborating artifact.

dfir.chwriteupAdded 13 Sep 2026, published 11 Sep 2026🛡️ Security

Huntress analyzed a fake GTA6 game ISO (some padded to 100GB+ with junk data) distributed via SEO poisoning, gaming forums, and torrents ahead of the game's real release. The ISO's "installer" drops a Russian-language crack-themed installer that stages multiple NJRAT copies, a DCRAT implant, the Mercurial Grabber infostealer (exfiltrating browser/Discord/Roblox/Minecraft data via Discord webhooks), Chaos ransomware repurposed as a destructive wiper (with a fake "license not found" error to mask the compromise), and an unexplained Yandex Browser install. The writeup includes IOCs (C2 IPs, ngrok tunnel, hosts-file modifications, malicious Discord webhook URL) and notes current Windows Defender detects the components.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Huntress SOC details two August incidents where phishing emails led victims through a fake CAPTCHA/Adobe PDF Reader lure into a browser-in-the-browser (BiTB) page spoofing get.adobe.com, tricking them into installing a ScreenConnect client disguised as an Adobe Reader update. The installer chained to a second rogue ScreenConnect client via curl/cmd.exe, both registered as Windows services for persistence, then executed defense-evasion binaries (HideCursor.exe, HideUL.exe) to hide cursor/screen activity before Huntress disrupted the intrusions. Full IOCs (domains, ScreenConnect client IDs/relays, file hashes/paths) are included for defenders.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Huntress researchers uncovered the operator console for "Knight Office," a Flask-based adversary-in-the-middle (AiTM) phishing kit used to steal Microsoft 365 session tokens via a DocuSign-themed, self-spoofed lure that routes victims through Monday.com redirects and a compromised Joomla site to a fake Microsoft device-code authentication page. After capturing tokens, the attacker registered a rogue device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the compromised account to maintain persistent, MFA-bypassing access even after token revocation. The writeup details IOCs (IPs, .vu domains, User-Agent strings), links the campaign to hundreds of reported phishing emails since April, and gives defenders concrete hunting/response steps around callback-proxy sign-ins and newly registered WHfB credentials.

huntress.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Huntress details a phishing campaign that tricks victims into installing a legitimately signed Faronics Deploy agent disguised as Adobe/Zoom documents, enrolling endpoints into an attacker-controlled deployment console. The threat actors then abuse Faronics' remote script execution to pull PowerShell payloads (via curl, mshta, msiexec) from GitHub-hosted staging and install ScreenConnect for persistent remote access. The post identifies key forensic artifacts (C:\ProgramData\Faronics\Logs\ScriptRunner.log and the deployment's unique "ck" identifier) that defenders can use to trace attacker infrastructure and cluster malicious enrollments, and notes Faronics' response to disrupt abuse after Huntress's disclosure.

huntress.comwriteupAdded 5 Sep 2026, published 31 Aug 2026🛡️ Security

Deep-dive intelligence report on Majinahanashi, a Japanese-themed ransomware group that emerged in August 2026, covering its Tor data-leak site (math-captcha gated, non-vanity domain), victimology (15 victims across Europe/Asia/Latin America, avoiding US/English-speaking countries), and technical analysis of its C/C++ locker sample. The malware uses AES-256 with RSA-wrapped per-file keys, appends the .MAJIN extension, deletes shadow copies/USN journals/event logs via vssadmin/bcdedit/fsutil, hijacks the desktop wallpaper, and uses WFP-based network filtering plus I/O priority manipulation to suppress EDR/backup traffic (targeting CrowdStrike, SentinelOne, Defender, Veeam, etc.). The article includes a full YARA detection rule, the ransom note text, BTC/qTOX/email contact IOCs, and threat-actor profiling ("THE DOCTOR CAME" persona) plus links to Mimikatz and Advanced IP Scanner usage.

theravenfile.comwriteupAdded 3 Sep 2026, published 14 Aug 2026🛡️ Security

Huntress details an Akira ransomware intrusion from August 2026 that followed the group's usual SonicWall SSL VPN → domain controller → AD enumeration → WinRAR/s5cmd exfiltration → detonation playbook, but with a new twist: the affiliate ran msconfig.exe to force a reboot into Safe Mode with Networking (MITRE T1688), which killed the Huntress agent and Windows Defender real-time protection while preserving network access, after pre-registering an AnyDesk service to survive the minimal Safe Mode driver set. The blog notes Safe Mode's constrained virtual memory appears to have caused akira.exe to crash with out-of-memory errors, accidentally sabotaging the attacker's own encryption run, and closes with detection guidance for boot-configuration changes, Safe Mode Kernel-Boot/Kernel-General event IDs, and Safe Boot registry tampering.

huntress.comwriteupAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

Huntress details a second 2026 wave of device code phishing against Microsoft 365, this time abusing VPS reseller BL Networks (BitLaunch/BLNWX, AS399629) after an earlier wave tied to Railway and the EvilTokens phishing-as-a-service kit. Huntress observed 533 malicious events and 113 successful logins from a single BL Networks IP in April, spreading across multiple IPs and subnets by May, with 26 critical incidents across 23 identities logged in July, and argues defenders must stop trusting infrastructure reputation and instead hunt for anomalous device-code sign-in clusters and revoke tokens quickly. It ties the activity to the broader legitimate-cloud-plus-legitimate-Microsoft-auth-page attack pattern also seen with Railway, EvilTokens, and Kali365.

huntress.comwriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Huntress reverse-engineers MacSync, a macOS stealer-and-RAT chain delivered via a weaponised claude.ai share link promoted through Google Ads malvertising, where a victim searching for how to install Claude on a Mac pastes a curl piped to zsh one-liner. The writeup traces all six stages: a polymorphic zsh loader, a server-side AppleScript that social-engineers Full Disk Access and validates the account password via dscl authonly, keychain and browser Safe Storage theft, a statically-linked C++ Mach-O RAT with WebSocket and AES-CBC C2 plus LaunchAgent persistence disguised as legitimate updaters, a signed Screen Recording-badged helper that phishes the TCC screen-capture permission, and trojanised Electron wallet apps (Ledger Live and Ledger Wallet) that inject a fake recovery-phrase phishing flow. It ties the kit to the AMOS and Atomic Stealer lineage via Russian-language code comments and shared infrastructure, and documents concrete IOCs including domains, C2 IP, mutex naming, and plist patterns for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 29 Jul 2026🛡️ Security

Huntress SOC tracked a credential stuffing campaign against SonicWall VPN/firewall logins starting July 25, 2026, originating from five DigitalOcean-hosted IPs. Over three days, 92 unique user accounts across 30 organizations were compromised through opportunistic, automated credential validation rather than targeted attacks, with no observed post-compromise activity. The post includes IoCs and mitigation guidance (WAN access restriction, credential resets, MFA enforcement) for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Huntress details two firsthand incident-response engagements against SafePay, a closed (non-RaaS) double-extortion ransomware group active since late 2024 that has claimed 270+ victims in 2025. The writeup covers the intrusion chains (RDP access, Defender disabling via LOLBins, ShareFinder.ps1 share discovery, WinRAR/FileZilla staging and exfiltration, regsvr32-loaded locker.dll encryption), reverse-engineers the ransomware binary showing heavy code overlap with leaked LockBit Black source (including a Cyrillic-language kill switch, XOR string obfuscation, token impersonation via DuplicateToken/ZwSetThreadInformation, and custom anti-analysis thread creation), and provides Sigma detection rules for Defender-tampering-via-GUI and the CMSTPLUA/ICMLuaUtil COM UAC bypass technique.

huntress.comwriteupAdded 3 Sep 2026, published 17 Jul 2026🛡️ Security

Huntress SOC analysis of a June incident where a threat actor exploited a SQL injection flaw in an IIS/MSSQL web application to gain access, then extensively modified the environment: enabling Terminal Services, creating a rogue admin account (adminweb2$), disabling Windows Defender, deploying BadIIS malicious IIS modules (HttpFastCgiModule.dll, HttpCgiModule.dll) for SEO fraud, installing the XMRig cryptominer with nssm.exe persistence and hidden/system file attributes, and dropping additional PowerShell/batch payloads (qdcjoke1.2.ps1, c_joke1.2.ps1) via base64-encoded PowerShell and Out-of-Band Application Security Testing (OAST) exfiltration channels (oastify.com).

huntress.comwriteupAdded 3 Sep 2026, published 13 Jul 2026🛡️ Security

Huntress recovered and reconstructed "Untitled1.ps1," a PowerShell Active Directory enumeration script used by an attacker during a June 3 incident via RDP access with compromised credentials, and identified it as AI-generated ("vibe-coded") based on artifacts like an unedited LLM placeholder hostname, a "FULLY FIXED" prompt-iteration title, over-engineered five-method DC-discovery fallback logic, and gratuitous colored console/HTML reporting output. The attack chain paired this bespoke recon tool with off-the-shelf abuse of s5cmd (legitimate AWS S3 CLI used for exfiltration) and SharpShares (share enumeration), illustrating how LLM-generated one-off malware evades hash/signature-based detection and pushes defenders toward behavioral analytics on Active Directory enumeration patterns.

huntress.comwriteupAdded 3 Sep 2026, published 8 Jul 2026🛡️ Security

Trail of Bits' Patch the Planet initiative (a collaboration with OpenAI pairing engineers with 30+ open-source projects) had GPT-5.5-Cyber, driven through Codex's /goal command, autonomously build a full fuzzing lab against zlib in a single day. Without step-by-step guidance, the model wrote ASan/UBSan-instrumented harnesses across a dozen entrypoints (inflate, inflateBack, uncompress2, gzFile, MiniZip, puff, blast, infback9, gzjoin, gzappend), used compile-time variant builds to reach hidden code paths, repurposed edge-case tests as seed corpus, and applied strict reportability discipline to reject unreachable crashes while surfacing several findings now under coordinated disclosure. The report argues this collapses the expertise barrier that historically kept bespoke fuzzing campaigns out of reach for low-skill attackers while also acting as a major force multiplier for defenders/researchers.

blog.trailofbits.comwriteupAdded 3 Sep 2026, published 2 Jul 2026🛡️ Security

Socket's Threat Research Team analyzed "VPN Go: Free VPN" (Chrome Web Store, extension ID jgpfgonjjolillilkjfkiddakagkkpoj) and "Free VPN by VPN GO" (Firefox Add-ons), showing both shipped clean initial versions that later received malicious updates adding clipboard-monitoring "clipper" logic. The extensions poll the clipboard every 500ms (Chrome) or 1.5s (Firefox), chunk newly copied text, and exfiltrate it via GET requests to hardcoded IPs (178.236.252.133, 178.236.252.161, 77.91.123.187) at /html/continue.php, while real proxy/VPN functionality is retained as cover. The writeup includes deobfuscated code, version-by-version infrastructure changes, file hashes, bearer tokens, and MITRE ATT&CK technique mapping for defenders.

socket.devwriteupPublished and added 30 Jun 2026🛡️ Security

Huntress SOC incident writeup detailing a threat actor who exploited Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) to drop a steganographic webshell hidden inside an image, then returned with a full defense-impairment batch script (i.bat) that disabled IIS logging, tampered with Windows Defender, killed/deleted security services (Sysmon, filebeat, SentinelOne, DrWeb, ImmunetProtect), used Image File Execution Options to freeze logging tools, deleted ModSecurity WAF module, enumerated FileZilla and multilingual local admin groups, weakened WDigest to force plaintext credentials in memory, dumped credentials via a Mimikatz kernel driver (mimidrv.sys), deleted CLSID/WScript registry keys, and cleared Windows event logs. The piece walks through each command block with attacker rationale and closes with concrete mitigation guidance for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 29 Jun 2026🛡️ Security

Microsoft Security Research disclosed "AutoJack," an exploit chain in AutoGen Studio (the prototyping UI for Microsoft's AutoGen multi-agent framework) where an agent with browsing capability (e.g., MultimodalWebSurfer) that renders an attacker-controlled webpage can be jacked into opening a WebSocket to the local MCP control plane at /api/mcp/ws. The chain combines three flaws: a localhost-only origin allowlist that the agent's own headless browser satisfies (CWE-1385), an auth middleware that explicitly skips /api/mcp/* paths without the intended WebSocket-level check (CWE-306), and a server_params query parameter that is base64-decoded into StdioServerParams and executed verbatim via stdio_client with no executable allowlist (CWE-78) — letting the page spawn calc.exe or arbitrary commands under the developer's account with no user interaction beyond the agent rendering the page. The issue was fixed pre-PyPI-release upstream (commit b047730) and never shipped in the published autogenstudio package; Microsoft provides mitigation guidance and Defender advanced hunting KQL queries to detect the pattern (suspicious child processes from autogenstudio, WebSocket calls carrying server_params, browser-automation processes reaching non-corporate domains).

microsoft.comwriteupAdded 20 Jun 2026, published 19 Jun 2026🛡️ Security

Huntress SOC details an Akira ransomware incident where a threat actor accessed a hypervisor, spun up a new VM (bypassing EDR since it lacked the Huntress agent), disabled Microsoft Defender, and deployed a renamed akira.exe encryptor. Notably, the actor exfiltrated staged WinRAR archives via Easyupload.io, a file-upload service run by the rebranded former peer-to-peer client LimeWire, alongside earlier use of WinSCP for exfiltration.

huntress.comwriteupAdded 3 Sep 2026, published 12 Jun 2026🛡️ Security

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

huntress.comwriteupAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

RETooling researchers reverse-engineer Microsoft Defender Antivirus (MDA), detailing the .vdm signature database format, the MpEngine.dll module loading/signal-dispatch process, and the internal structure of PEHSTR and PEHSTR_EXT byte/string-matching signatures used to detect PE malware. The post decodes the wildcard opcode family (0x90 0x01–0x05) used in Defender signatures and shows Yara-equivalent translations plus a worked example bypassing a Plugx.C detection by modifying a single matched byte, framing the work as groundwork for adversary emulation and signature evasion.

retooling.iowriteupAdded 3 Sep 2026, published 22 May 2026🛡️ Security

Huntress SOC details two Gentlemen ransomware incidents showing Windows Event Log clearing, PowerShell-based Defender tampering, and Scheduled Task persistence via a fake svchost32.exe creating a SOCKS proxy C2 connection. Ties findings to a leaked internal RaaS database revealing CVE-2024-55591 exploitation and infrastructure links to Qilin and Lazarus Group.

huntress.comwriteupAdded 3 Sep 2026, published 21 May 2026🛡️ Security

Huntress SOC breaks down how attackers disable AV/EDR: blocking agent communications via malicious/hidden Windows Firewall rules (WFP), abusing Add/Remove or CLI to uninstall EDR agents, abusing Defender AV exclusions, and Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel access and kill protected security processes. Includes real intrusion examples — a February 2026 SonicWall VPN-credential intrusion using a revoked-but-still-trusted 2006 EnCase forensic driver (exploiting a legacy Windows Driver Signature Enforcement exception) to kill 59 named security processes every second, and a March 2026 malvertising campaign (Google Ads for W-2/W-9 forms) that dropped a rogue ScreenConnect instance and used a vulnerable signed Huawei audio driver to terminate EDR/AV processes.

huntress.comwriteupAdded 3 Sep 2026, published 18 May 2026🛡️ Security

Adversa AI's TrustFall report shows that Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI all auto-execute project-defined MCP servers as unsandboxed OS processes the instant a user accepts the generic folder-trust prompt, with no mention of code execution in Claude Code's v2.1+ dialog. A malicious repo needs only two JSON files (.claude/settings.json with enableAllProjectMcpServers/enabledMcpjsonServers/permissions.allow, plus an inline-payload .mcp.json) to achieve one-Enter-keypress RCE with full user privileges, and the same chain runs with zero human interaction against CI runners using the official claude-code-action since headless mode skips the trust dialog entirely. The report documents Anthropic's declination of the finding as intended behavior, contrasts it with the stricter bypassPermissions warning flow, references the related CVE-2025-59536 patch, and ships defender mitigations (managed-settings lockdown, config auditing, CI branch restrictions) plus a safe PoC.

adversa.aiwriteupAdded 20 May 2026, published 7 May 2026🛡️ Security

The author describes IronCurtain, an open-source finite-state-machine orchestration framework for agentic security research, and a vuln-discovery workflow built on top of it that autonomously hunts for zero-days. Using an Orchestrator agent, an append-only journal, and tiered harness-building (single-function fuzzing up to full QEMU-based VM validation), the workflow replicated the historical 1998 OpenBSD TCP SACK kernel panic with Opus 4.6/Sonnet 4.6, and independently found previously unreported bugs in a widely-deployed media framework and an 18-year-old integer truncation flaw in another foundational library — the latter run entirely on Z.AI's GLM 5.1 via a LiteLLM gateway swapped in place of Anthropic models. The piece argues that PoC generation (not static findings) is what matters for defenders, that open orchestration plus commodity/open-weight models can match "frontier" vulnerability-discovery capability at $30–$150 per codebase, and that AUP refusals during severity assessment create asymmetric friction for defenders versus unrestricted adversaries.

provos.orgwriteupPublished and added 7 May 2026🛡️ Security

Huntress documents Dragon Boss Solutions LLC, a code-signed adware/PUP vendor whose off-the-shelf Advanced Installer update mechanism was configured to poll an unregistered domain (chromsterabrowser[.]com) for updates, meaning anyone who registered it for $10 could push arbitrary payloads with SYSTEM privileges to every infected host. The deployed payload, ClockRemoval.ps1, kills AV processes via WMI event subscriptions and a 100ms polling loop, disables AV services, poisons the hosts file against AV update domains, and carves out Windows Defender exclusions for future payload staging. Huntress registered the domain first, sinkholed it, and observed 23,565 unique infected hosts across 124 countries within 24 hours, including universities, OT/critical infrastructure networks, government entities, and Fortune 500 companies.

huntress.comwriteupAdded 3 Sep 2026, published 14 Apr 2026🛡️ Security

Huntress Tactical Response documents an active malvertising campaign (since Jan 2026) that uses Google Ads for tax-form searches (W-2/W-9) to deliver rogue ScreenConnect installers, leading to a BYOVD EDR killer that abuses a previously undocumented signed Huawei audio driver to terminate Defender, Kaspersky, and SentinelOne from kernel mode. The attack chain includes dual commercial cloaking services (JustCloakIt, Adspect) to evade researchers, a multi-stage crypter using a 2GB memory allocation trick to evade AV, stacked RMM tools (ScreenConnect, FleetDeck) for persistence, and post-EDR-kill LSASS dumping plus lateral credential harvesting via NetExec - consistent with a pre-ransomware/IAB playbook. The report also links a fake Chrome update page with Russian-language JS comments to the same operator's infrastructure.

huntress.comwriteupAdded 3 Sep 2026, published 19 Mar 2026🛡️ Security

Huntress SOC incident writeup describing how attackers breached a small US construction manufacturer via a VPN lacking two-factor authentication, then used RDP for reconnaissance, dumped credentials after lateral movement, and attempted to disable Microsoft Defender and the Huntress EDR agent. The SOC's triage, support, and tactical response teams detected the activity via Managed EDR, isolated the network, reviewed VPN logs, and remediated by disabling compromised accounts and enabling 2FA before ransomware deployment occurred.

huntress.comwriteupAdded 3 Sep 2026, published 13 Mar 2026🛡️ Security

Huntress SOC details two related incidents where threat actors used PsExec for privilege escalation, a scheduled task ("Recovery Diagnostics") to run base64-encoded PowerShell that configured a renamed copy of restic (winupdate.exe) pointed at a Wasabi S3 bucket, then disabled/removed VIPRE Business Agent and Windows Defender before deploying INC ransomware. A second, near-identical prior incident on 9 February reused the same AWS access keys and used HRSword to disable Acronis security tooling, and the same TTPs were independently documented by the Cyber Centaurs team on 22 January 2026. The post highlights detection gaps (incomplete agent deployment, no SIEM) and notes RestartManager API telemetry (also seen with Akira) as a ransomware-encryption indicator.

huntress.comwriteupAdded 3 Sep 2026, published 12 Mar 2026🛡️ Security

Huntress details active exploitation of SolarWinds Web Help Desk deserialization vulnerabilities (CVE-2025-26399, plus CVE-2025-40551 which is in CISA KEV, and CVE-2025-40536) across three customer intrusions, tracing an attack chain from wrapper.exe/java.exe spawning silent MSI installs of Zoho Assist, through Velociraptor abused as a C2 framework, a Cloudflare Workers/mooo.com HTTP-406-triggered C2 failover mechanism, Get-ComputerInfo exfiltration to an attacker-run Elastic Cloud instance, Windows Defender/Firewall disabling via registry edits, and QEMU-based SSH backdoor persistence via a "TPMProfiler" scheduled task. It provides mitigation guidance (patch to WHD 2026.1, remove admin interface from the internet, reset credentials) and links to Sigma detection rules.

huntress.comwriteupAdded 3 Sep 2026, published 8 Feb 2026🛡️ Security

Huntress DFIR writeup analyzing three related intrusions (Nov 6, 17, 25) that all began with command execution via IIS's w3wp.exe against custom login/web pages, followed by attempts to deploy a Golang trojan (agent.exe, identified in one case as SparkRAT) using certutil.exe as a LOLBin downloader. Using EDR telemetry, Sysmon, and IIS/web logs, the analysts trace repeated failures — Windows Defender blocks, failed service starts for a "WindowsUpdate" persistence service, mistyped/unsuccessful executions — and show how the same actor adapted between incidents by proactively adding Windows Defender exclusions and later deploying a renamed GotoHTTP RMM tool, illustrating that real intrusions are messier and more iterative than the "sophisticated playbook" narrative suggests.

huntress.comwriteupAdded 3 Sep 2026, published 22 Dec 2025🛡️ Security

Huntress details a December 2025 incident where attackers used SEO poisoning to surface fake, attacker-created ChatGPT and Grok shared conversations as top Google results for benign queries like "clear disk space on macOS." Victims who followed the AI-formatted "troubleshooting" instructions and pasted a Terminal command triggered a multi-stage AMOS (Atomic macOS Stealer) infection: a bash loader silently validated the user's password via `dscl -authonly`, escalated to root via `sudo -S`, deployed a hidden `.helper` Mach-O payload, trojanized Ledger Wallet and Trezor Suite apps to steal seed phrases, and persisted via a LaunchDaemon-driven AppleScript watchdog that relaunches under the active GUI user's session every second. The piece is notable as the first documented case of AMOS using AI-platform-hosted content (rather than phishing or fake installers) as the initial lure, and includes defender detection guidance (monitoring osascript credential prompts, dscl -authonly usage, sudo -u with piped passwords, hidden dotfiles).

huntress.comwriteupAdded 3 Sep 2026, published 9 Dec 2025🛡️ Security

A DFIR.ch technical walkthrough of Linux POSIX capabilities: how to weaponize cap_setuid on a binary like /usr/bin/python3.12 with setcap to create a stealthy root-spawning backdoor without touching SUID bits, then how defenders can hunt for these via getcap -r, /proc status Cap* fields, LinPEAS, and an Elastic detection rule that flags setcap process execution. It also explains where capabilities live on disk (the security.capability extended attribute on the inode) and how to inspect/remove them with getfattr and setcap -r.

dfir.chwriteupAdded 3 Sep 2026, published 16 May 2025🛡️ Security

A DFIR consultant walks through two Microsoft Defender for Endpoint high-severity "Ransomware" alerts that turned out to be benign inbound TCP SYN scans (ConnectionAttempt, not InboundConnectionAccepted) from an IP Microsoft had classified as malicious. The post shares KQL queries against DeviceNetworkEvents to identify internet-facing devices (via RemoteIPType and InboundInternetScanInspected), explains the difference between ConnectionAttempt and InboundConnectionAccepted ActionTypes, and stresses correlating with DeviceLogonEvents before concluding an alert is a false positive.

dfir.chwriteupAdded 3 Sep 2026, published 22 Jan 2025🛡️ Security

A DFIR investigation into mysterious domain admin accounts (e.g. "amol.paulson") appearing across an organization's devices, traced back to Microsoft Defender XDR's built-in deception capability, which auto-generates decoy accounts and hosts as lures. The post details how to identify a decoy-account login via local (not network) authentication preceded by a specific PowerShell script execution, and decodes the base64 JSON descriptor blob (containing DetectionKeys, LureDeploymentContext, UserRid, etc.) that reveals which decoy account triggered the alert — useful so defenders don't mistake this feature for an intrusion.

dfir.chwriteupAdded 3 Sep 2026, published 10 Oct 2024🛡️ Security

A DFIR.ch blog post examining how the threat actor TeamTNT abuses tmate (instant terminal sharing tool) as a Linux backdoor after compromising servers, referencing prior TeamTNT reporting from Intezer, ASEC, and Aqua. The author demonstrates tmate installation/usage and walks through forensic artifacts left behind — process listings, apt logs, unattended-upgrades-dpkg.log, /proc/net/unix socket entries, and lsof output showing outgoing SSH connections to tmate's infrastructure — to help defenders and threat hunters detect active or past tmate-based backdoors.

dfir.chwriteupAdded 3 Sep 2026, published 6 Oct 2024🛡️ Security

A technical KQL deep-dive on detecting hands-on-keyboard attacker activity by correlating multiple suspicious process executions (route.exe, quser.exe, curl.exe, setspn.exe, klist.exe) within a time window on the same device. The author explains why bin()/bin_at() bucketing and Near-Real-Time (NRT) analytic rules are unreliable for temporal-proximity detections, then walks through using the row_window_session() window function with MaxDistanceFromFirst, MaxDistanceBetweenNeighbors, and a Restart expression to build accurate session-based correlation across DeviceProcessEvents in Microsoft Defender XDR.

attackthesoc.comwriteupAdded 3 Sep 2026, published 15 Sep 2024🛡️ Security

A DFIR.ch lab writeup that tests BC-Security's ScriptBlock Smuggling technique, which abuses PowerShell's ScriptBlockAst to make malicious code execute while a spoofed benign-looking script gets written to the Script Block log (Event 4104), bypassing AMSI without reflection or memory patching. The author shows that while the 4104 log is indeed spoofed, PowerShell Module Logging (Event 4103) still captures the real executed code, and Windows Defender/AMSI flagged the test payload as Trojan:PowerShell/ScriptSmug.A, meaning defenders retain multiple detection opportunities. It also references an AtomicRedTeam test for the technique and notes in-the-wild adoption to deliver Vidar-Stealer.

dfir.chwriteupAdded 3 Sep 2026, published 13 Sep 2024🛡️ Security

A detection engineering methodology post arguing that UEBA/behavior detections should be built around defining undesirable 'states/conditions' rather than chasing mutable 'activity', citing Florian Roth's detection engineering framework. It walks through a worked example: detecting Shadow Credentials attacks (anomalous additions to the AD msDS-KeyCredentialLink attribute) by correlating Windows Event ID 5136 (directory service object modified) with Event ID 4624 (logon) and Microsoft Defender XDR's DeviceNetworkInfo table to flag KCL writes originating from IPs never associated with the target computer, complete with a full KQL query.

attackthesoc.comwriteupAdded 3 Sep 2026, published 7 Jul 2024🛡️ Security

dfir.ch documents an incident response investigation where an NDR sensor flagged a suspicious internal port scan. The analyst used EDR telemetry to identify the responsible PowerShell script (hash-verified, Microsoft-signed) invoking Defender for Endpoint's Device Discovery feature (Scan-UdpTcpPorts, Scan-Vnc, Scan-WinRm, etc.), decoding its base64 ScannerArgs to reveal target IPs, MACs, and the CVEs it probes for (CVE-2021-44228, CVE-2022-22965). The scan turned out to be benign legitimate network discovery from Defender for Endpoint, explaining why it triggered an NDR false positive.

dfir.chwriteupAdded 3 Sep 2026, published 27 Apr 2024🛡️ Security

A practical deception-engineering guide showing how to "stack" Microsoft Defender XDR's native Deception rules (basic/advanced lures, decoy hosts, credentials) with Thinkst Canarytokens (tokenized PDFs, custom EXEs, DNS/AWS-key tokens) to close detection gaps. It walks through generating tokens on Canarytokens.com, embedding them as lure files in Defender XDR deception rules, and routing alerts via email/Teams/Slack or an Azure Logic App into Microsoft Sentinel for SOC-integrated incident creation.

attackthesoc.comwriteupAdded 3 Sep 2026, published 21 Apr 2024🛡️ Security

A practical guide to the "Sentinel activities" feature in the unified Microsoft Sentinel/Defender XDR portal, which surfaces entity behavior (alerts, bookmarks, anomalies, custom activities) directly on identity/device/IP pages. The author walks through creating a custom activity that queries an OktaSSO custom log table via KQL to flag privileged Okta changes made by a user, then displays the enriched result in that user's entity timeline, and notes current limitations (no historical backfill, no pivot-to-hunting link).

attackthesoc.comwriteupAdded 3 Sep 2026, published 13 Apr 2024🛡️ Security

A DFIR case study of an AWS S3 extortion incident where an attacker deleted a customer's buckets after reconnaissance (GetSendQuota, ListBuckets, GetBucketVersioning, etc.) and left a Bitcoin ransom note bundled with a Linux 'recovery' binary. Analysis with strace and Ghidra reveals the recovery tool is a complete fake: it never contacts AWS or the network, instead sleeping via clock_nanosleep and fabricating account/bucket details from a bundled aws.txt file to pressure the victim into paying. The post also shares specific CloudTrail event names defenders should monitor to detect similar pre-deletion recon activity.

dfir.chwriteupAdded 3 Sep 2026, published 21 Feb 2024🛡️ Security

A FIRST Conference 2023 research writeup analyzing ten top malware families active in Switzerland (Nanocore RAT, Ave Maria RAT, QakBot, 404 Keylogger, Loki Password Stealer, Remcos RAT, etc.) to find eight common post-infection forensic artifacts: Windows Defender exclusion creation (event 5007), PowerShell Script Block logging, scheduled task creation (events 4698-4702), Run key persistence, Startup folder drops, AppData file writes, Dynamic DNS resolutions, and high-port/IP-only network connections. Each artifact is mapped to specific detection methods using Sysmon event IDs, Windows event logs, and Velociraptor hunts (TaskScheduler, DNSCache), giving SOC analysts and IR teams concrete, low-cost threat-hunting queries applicable beyond the specific samples studied.

dfir.chwriteupAdded 3 Sep 2026, published 31 Dec 2023🛡️ Security

Details CVE-2023-36631, a missing access-control flaw in Malwarebytes' Binisoft Windows Firewall Control (wfc.exe/wfcs.exe) that lets any unprivileged local user export, import, or reset Windows Defender Firewall rules without authentication, fully bypassing firewall protections. The author walks through PoC steps for the export/import/reset actions and documents Malwarebytes' HackerOne disclosure, which was initially closed as 'informative' before a CVE was ultimately assigned. It also references a related 2022 CVE-2022-25150 in the same product's Tools tab that allowed local privilege escalation.

bencteux.frwriteupAdded 3 Sep 2026, published 21 Jun 2023🛡️ Security

Describes abusing the built-in Windows doskey command to define macros/aliases that hide the real executable (e.g. powershell.exe, or a chained download+ProcDump LSASS dump) from command-line-based detection. By defining macros on an attacker machine, exporting them with `doskey /m`, and importing them on the target via `doskey /macrofile=`, the sensitive command never appears on the target's command line, only the short alias does. The author notes this bypasses shallow command-line logging but not lower-level hooks, and suggests defenders monitor/alert on doskey usage since it's rarely used in modern environments.

bencteux.frwriteupAdded 3 Sep 2026, published 22 Oct 2022🛡️ Security

Details five ways to execute code on an Azure VM beyond RDP/SSH: the Run Command agent, Custom Script Extension, Desired State Configuration (DSC) extension abuse, VM Application Definitions, and Hybrid Worker Groups — all running as SYSTEM/root by default. For each technique the author gives the exact PowerShell/Az cmdlets (including PowerZure's Invoke-AzureRunProgram and Invoke-AzureVMCustomScriptExtension), on-disk artifact paths, and the specific Azure Activity Log events (e.g. 'Run Command on Virtual machine', 'Create or Update Virtual Machine Extension') defenders should correlate on.

hausec.comwriteupAdded 3 Sep 2026, published 4 May 2022🛡️ Security