Threats Tagged 'indicator'

This information describes an update to a publicly available STIX feed used for sharing cyber threat intelligence indicators. The update improves the feed's structure by implementing proper STIX 2.1 object hierarchies, including IPv4Address SCOs with deterministic UUIDs and relationships linking indicators to malware families. This enhancement facilitates better integration and deduplication when used alongside multiple threat feeds, improving the accuracy and usability of threat intelligence platforms like OpenCTI. There is no direct security vulnerability or exploit described, and no known active exploitation in the wild. The update is a technical improvement to a threat intelligence feed rather than a new malware or attack vector. European organizations relying on threat intelligence feeds can benefit from more precise and interoperable data, but this does not represent a direct threat. The suggested severity is low since this is an intelligence feed improvement without direct impact on confidentiality, integrity, or availability.

MediumMalwareGermanyFranceNetherlands+4#netsec#reddit#malware

There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.

CriticalPhishingGermanyFranceNetherlands+7#netsec#reddit#high-priority

In the past few years, I’ve worked closely with enterprise security teams to improve their open source governance processes. One recurring theme I keep seeing is this: most organizations *know* they have issues with OSS component vulnerabilities—but they’re stuck when it comes to actually governing them. To better understand this, we analyzed the top 20 most vulnerable open source components commonly found in enterprise Java stacks (e.g., `jackson-databind`, `shiro`, `mysql-connector-java`) and realized something important: Vulnerabilities aren’t just about CVE counts—they’re indicators of systemic governance blind spots. Here’s the full article with breakdowns: [**From the Top 20 Open Source Component Vulnerabilities: Rethinking the Challenges of Open Source Security Governance**](#)

HighNewsGermanyFranceNetherlands+4#netsec#reddit#rce

Hi all, I am a cybersecurity analyst with 1 year and 6 month experience. Im writing this for fun and to teach some people who maybe interested and are at a beginner level on detecting suspicious sign in activity. In my example Im going to be using Entra ID, as this is the most common IAM solution and the one Im most familiar monitoring. First step is analyzing the alert you received in the queue. "Impossible travel time" or "Anomalous sign in activity" "sign in from bad IP" - These are the type of suspicious authentication logs that you will see in the SOC. Gather all the information: time generated (time of the sign in) app that was logged into (ex officehome, msgraph) username/email IP address device info (will normally be blank if its tuned properly, if its coming from managed trusted AD device it is a big indicator its benign so need to tune it to avoid FP for VPN usuage) locationdetails (will be crucial to see which location logged from, will determine later if its physical location or location from VPN server) user agent (crucial to detect what type of device it's coming from, potential spoofing as well) Then you can run a query like this (will differ greatly based off your SIEM querying lanaguage, Im using Kusto MS Sentinel) Signinlogs | Summarize count by timegenerated, appname ,userprincipalname, IPaddress, tostring(locationdetails), tostring(deviceinfo), useragent | where resulttype == 0 (filtering to see successful sign in attempts only) \^ use a query like this to gather all crucial details, we can then use the time range to see 24 hours and then compare past previous sign ins from last 2-3 weeks to see a baseline, for location, IP address, device info, to see if they have accessed that app before. Once you determine the sign in activity is indeed suspicious, its a combination of blank device details (non managed device), new IP address, new useragent or a suspicious useragent (potential spoofed), new app that's been used and potential impossible travel based off the last successful login). We need to analyze what type of IP address is being used, from either a VPN server or a ISP IP (will show approximate physical location of actual sign in). NEVER just focus on the IP reputation, vast majority of the true positives I caught are all coming from clean IP reputations, threat actors are smart enough to know that if their IP address has been flagged and reported numerous times, their sign in activity will be blocked. Analyze the ISP info, a threat actor MAJORITY of the time will be using an IP address from a suspicious VPN server, you can do a ISP search for that VPN name and most of the time it will be something foreign. Once you confirm the IP is coming from a suspicious entity such as a VPN server that is not authorized to be used in the company or its a VPN server with suspicious name, can confirm it's indeed malicious. From there you can quickly check Auditlogs table to see any major changes to the users account. Most threat actors will remove and change the comprised users MFA, will remove the comprised user mobile device and probably add theirs. From here, you can check the email logs and url click events on the suspicious link that was clicked for them to be comprised. Once you find that suspicious email you can plug that phishing URL into a interactive sandbox such as Browserling to confirm it. Some threat actors phishing sites are capable of detecting sandboxes and won't show their sign in page so be wary of that, but this isn't very common. After detecting all these suspicious events, you can begin to lock the users account, resetting MFA settings and starting the IR process and doing some forensics on what the threat actor did. Will have to look for: \- Potential data exfiltration attempts. Can detect this from email logs or web traffic logs. \- Potential lateral movement, the threat actor will likely send the same phishing email but this time from comprised users account to other internal users. Can detect this from email events as well. \- File modifications - the threat actor could have modified a file, deleted a file, for this can check logs such as office activity (365 events)

LowPhishingGermanyFranceNetherlands+7#netsec#reddit#high-priority

In the high-stakes arena of cybersecurity, Microsoft Defender stands as a cornerstone ofWindows security, integrating a sophisticated array of defenses: the Antimalware Scan Interface (AMSI) for runtime script scanning, Endpoint Detection and Response (EDR) forreal-time telemetry, cloud-based reputation services for file analysis, sandboxing for isolated execution, and machine learning-driven heuristics for behavioral detection. Despiteits robust architecture, attackers increasingly bypass these defenses—not by exploitingcode-level vulnerabilities within the Microsoft Security Response Center’s (MSRC) service boundaries, but by targeting logical vulnerabilities in Defender’s decision-makingand analysis pipelines. These logical attacks manipulate the system’s own rules, turningits complexity into a weapon against it.This article series, Strengthening Microsoft Defender: Analyzing and Countering Logical Evasion Techniques, is designed to empower Blue Teams, security researchers, threathunters, and system administrators with the knowledge to understand, detect, and neutralize these threats. By framing logical evasion techniques as threat models and providingactionable Indicators of Compromise (IoCs) and defensive strategies, we aim to bridgethe gap between attacker ingenuity and defender resilience. Our approach is grounded inethical research, responsible disclosure, and practical application, ensuring that defenderscan anticipate and counter sophisticated attacks without crossing legal or ethical lines.

HighToolGermanyFranceItaly+7#netsec#reddit#exploit