Threats tagged 'ioc'

I recently investigated a Red Bull-themed phishing campaign that bypassed all email protections and landed in user inboxes. The attacker used trusted infrastructure via post.xero.com and Mailgun, a classic living off trusted sites tactic. SPF, DKIM and DMARC all passed. TLS certs were valid. This campaign bypassed enterprise grade filters cleanly... By using advanced phishing email analysis including header analysis, JARM fingerprinting, infra mapping - we rolled out KQL detections to customers. Key Takeway: No matter how good your phishing protections are, determined attackers will find ways around them. That's where a human-led analysis makes the difference. Full write-up (with detailed analysis, KQL detections & IOCs) https://evalian.co.uk/inside-a-red-bull-themed-recruitment-phishing-campaign/

Phishing#netsec#redditGermany+6

In the high-stakes arena of cybersecurity, Microsoft Defender stands as a cornerstone ofWindows security, integrating a sophisticated array of defenses: the Antimalware Scan Interface (AMSI) for runtime script scanning, Endpoint Detection and Response (EDR) forreal-time telemetry, cloud-based reputation services for file analysis, sandboxing for isolated execution, and machine learning-driven heuristics for behavioral detection. Despiteits robust architecture, attackers increasingly bypass these defenses—not by exploitingcode-level vulnerabilities within the Microsoft Security Response Center’s (MSRC) service boundaries, but by targeting logical vulnerabilities in Defender’s decision-makingand analysis pipelines. These logical attacks manipulate the system’s own rules, turningits complexity into a weapon against it.This article series, Strengthening Microsoft Defender: Analyzing and Countering Logical Evasion Techniques, is designed to empower Blue Teams, security researchers, threathunters, and system administrators with the knowledge to understand, detect, and neutralize these threats. By framing logical evasion techniques as threat models and providingactionable Indicators of Compromise (IoCs) and defensive strategies, we aim to bridgethe gap between attacker ingenuity and defender resilience. Our approach is grounded inethical research, responsible disclosure, and practical application, ensuring that defenderscan anticipate and counter sophisticated attacks without crossing legal or ethical lines.

Tool#netsec#redditGermany+9