Ulrich Fleck

🕵️‍♀️ Legit on the surface. Malicious underneath. Cybercriminals are designing threats to look like normal activity. That’s why we joined forces with the MITRE Center for Threat-Informed Defense to develop Ambiguous Techniques—a new approach to identifying attacker behaviors that mimic legitimate actions. 💡 The result? Context-aware detection analytics that help defenders understand intent, improve SOC efficiency, and stay ahead of sophisticated adversaries. 🔗 Read how we’re advancing detection engineering: https://ftnt.net/60434abHU

110

2 Kommentare

SOC Monitoring for Legacy Systems If your SOC is well-acquainted with the organization's data sources, you can easily automate the assessment of potential threats and prioritize tasks for developing detections (as discussed here: https://lnkd.in/dW5mMf2f). But what if there's a poorly documented legacy system? You need to analyze the architecture, identify possible attack vectors, and cover them with relevant detections. And what if there are not just one but ten such non-standard systems? While the correct approach to monitoring sources is known, scaling it in practice is challenging. A promising alternative: conduct a quick analysis of the applicability of universal attack tactics and relevant detections for them. Here are the main events that can be covered with universal rules even in a non-standard system: Authentication anomalies: ▪️ Brute Force ▪️ Password spraying ▪️ Credential sharing ▪️ First logon to host (+ unsuccessful attempts) ▪️ First logon from host (+ unsuccessful attempts) ▪️ Tracking the client application profile used for login: browser fingerprint for web, SQL client for databases, application client, etc. Privilege manipulations: ▪️ Adding/removing users to/from a group ▪️ Changing access rights ▪️ Mass blocking/disabling of administrators ▪️ Account creation Network: ▪️ Change in the number of peers ▪️ Use of atypical network services for the system Processes and configurations: ▪️ Exporting protected resources outside the profile ▪️ Backup outside the profile ▪️ Managing backups outside the profile ▪️ Administration of security functions ▪️ Deleting security audit logs Using this approach, you can cover 11 out of 14 MITRE attack tactics, which is quite good for an unfamiliar system. #SOC #tips

28

📊 New from #ENISA: Preliminary Market Analysis on Managed Security Services (MSS) To better understand the current MSS landscape and support cybersecurity legislation with relevant market data, ENISA has published a preliminary MSS Market Analysis. The report looks at the market from both the demand and supply sides, covering: 🔹 MSS usage patterns 🔹 Compliance and skills certification 🔹 Threats, incidents, and requirements 🔹 Key challenges and market/research trends 🔗 Download the report: https://lnkd.in/d7-bJKrW

82

🚨 Critical SharePoint Vulnerabilities Under Active Exploitation 🛡️ Microsoft has confirmed that advanced persistent threat (APT) groups — including China-affiliated actors like APT27, APT31, and Storm-2603 — are exploiting multiple critical zero-day vulnerabilities in on-premises SharePoint Servers. 🎯 Over 400 organizations across government, healthcare, and manufacturing sectors have already been impacted. ⚠️ Even patched systems remain at risk if cryptographic keys are not rotated. 🛠️ CVE IDs: 1. CVE‑2025‑53770 (CVSS 9.8 – RCE & Auth Bypass) 2. CVE‑2025‑49701, 49704, 49706 (CVSS 8.8 – RCE) 3. CVE‑2025‑53771 (Path Traversal) 📌 Microsoft recommends: i. Immediate patching and updating to supported SharePoint versions ii. Rotation of ASP.NET machine keys and all cryptographic material iii. Enabling Antimalware Scan Interface (AMSI) iv. Disconnecting EOL/EOS SharePoint instances from the internet v. Audit and minimize layout and admin privileges ✅ At Inspira Enterprise, we help clients assess, patch, and harden SharePoint deployments against evolving threats. If you need assistance with remediation or threat hunting, we’re here to help. Write to us at coemicrosoft@inspiraenterprise.com to mitigate your organization's threats. 🧾Note : Inspira MDR clients are already under proactive monitoring. #CyberSecurity #SharePoint #ZeroDay #ThreatIntel #InspiraEnterprise #APT #Microsoft #CVE2025 #CyberThreats #RCE #Infosec #PatchNow Kartik Krishnan | Rajesh Ananthakrishnan | Vikas Chaturvedi | Ramesh Shanmugam | Kunal Vinayak Purandare | Dennis Joshua | Gaurav Makhija| Hiren Sadhwani | Pranjal Verma | Prashant Sharma |

62

🚨 Urgent Alert for IT Pros & CISOs: SharePoint on-premises is under active attack (CVE‑2025‑53770, CVSS 9.8) via the "ToolShell" exploit chain. Threat actors are installing web shells (like spinstall0.aspx), extracting machine keys, and moving laterally. ✅ Immediate actions: • Patch with July emergency updates • Enable AMSI + Microsoft Defender • Hunt for IOCs and malicious POST activity • Rotate cryptographic keys Details & detection tips are detailed in our latest community post. Don’t delay — this is actively exploited. Learn more here: https://lnkd.in/g9v9knUN

24

The key to securing Active Directory is being proactive about hardening policy, remediating underlying weaknesses and applying the principle of least privilege to the environment before a cyberattack. By reducing the paths from standard non-privileged users to privileged users, organizations give themselves the best chance of preventing Active Directory compromise. Weaknesses and misconfigurations within environments could allow threat actors to target Active Directory to gain access to privileged credentials and control of critical data and systems. These misconfigurations in Active Directory could often be an artifact of legacy services or other technical debt in corporate networks and can remain unknown to defenders until they are leveraged in a cyberattack. This month marks the 25th anniversary of Windows 2000, and many organizations have instances of Active Directory that are nearly that old. That is a lot of time for privileged access to accrue in the form of group memberships, service accounts, Access Control Lists (ACLs), security policies and other sensitive settings. Thus, it is important for organizations to regularly assess their environment and pursue a least privileged posture by revoking any elevated access that is not required. Additionally, taking steps such as disabling legacy authentication and communication protocols will raise the price of entry and deter attacker looking for an easy target. Active Directory compromise often starts with the compromise of a regular non-privileged user. Threat actors then use this account to perform reconnaissance against Active Directory, to find the shortest path to a Domain Admin or equivalent account. Some threat actors use open-source tools such ADRecon and BloodHound, or even built-in commands to enumerate the directory such as 'net user' or 'net group'. Nation-state actors and cybercriminals such as Peach Sandstorm, Octo Tempest, and others target weaknesses in security policy and other misconfigurations in Active Directory to obtain privileged credentials to achieve their goal, whether espionage, data theft, or even ransomware. Learn more about how to better secure Active Directory in this blog series by Jerry Devore about Active Directory hardening: https://msft.it/6048UhVGI Microsoft expert Matthew Zorich also shared key learnings on securing Active Directory based on Microsoft Incident Response engagements here: https://msft.it/6049UhVGL Microsoft Unified Support customers also have access to on-demand assessment tools for Active Directory that provide an analysis of critical workloads and predict and prescribe helpful next steps to improve and optimize the health of their environment. https://msft.it/6040UhVG0

306

2 Kommentare

The CVE Program — as we know it — just almost expired. MITRE’s contract to run the Common Vulnerabilities and Exposures (CVE) Program was to end April 16, 2025. That’s the system we all rely on to coordinate software vulnerability disclosures. No #CVE means no standardized alerts, no shared language for tracking threats, and a whole lot of chaos for defenders. Over 2,800 CVEs are issued monthly. Without continuity, threat actors get a head start — and defenders are stuck making up names like “That-One-Unpatched-Thing-In-The-Corner.” #CVE #Cybersecurity #OTSecurity #MITRE #CISA #MaxAI #CyberIn60Seconds #Resilience #mikeechols Leslie EcholsChuck BrooksChloe BurkeLes McCollum II, MPS-CRMCalvin Nobles, Ph.D.Danyetta Fleming Magana, CISSP, F. ISRMLaszlo Gonc, CISSP, QTESean C. Robert CraneLester Lewis, MBA#CISAntonio "T" ScurlockRoy White, MBA, PMPHoward TsaiTamika McCree ElhilaliJeffrey M. Vinson, Sr CISSP, CCISO, CIPP, NSA IAM-IEMGuy WaltonGotham ArtistsMatthew DimmickTim CooganJohn B MooreDeborah PageAdam Mohamed#aws #informationsharing #mikeechols

37

3 Kommentare

🛡️ Volt Typhoon is redefining cyber warfare—targeting identities, not just systems. This state-sponsored APT group is exploiting valid credentials, abusing legitimate tools, and staying under the radar to infiltrate critical infrastructure across energy, water, transportation, and telecom sectors. In our new blog, Veza’s Matthew Romero and Rob Rachwald unpack the identity-centric tactics behind Volt Typhoon—and provide a blueprint for CISOs and security teams to fight back. 📌 Learn how to: ✅ Detect living-off-the-land activity through access intelligence ✅ Eliminate overprivileged access and lateral movement pathways ✅ Monitor dormant and non-human identities that often go unnoticed ✅ Unify visibility across cloud, SaaS, on-prem, and OT environments 🔍 Read the blog: 👉 https://lnkd.in/deNKmnS3 Identity is now the primary attack vector. Veza helps you see it, secure it, and stay ahead of nation-state threats. #IdentitySecurity #VoltTyphoon #APT #SecOps #ZeroTrust #AccessSecurity

27

🚨 SentinelOne Uncovers 3 Distinct Attack Clusters Targeting Microsoft SharePoint: As part of the “ToolShell” Zero-Day being exploited in-the-wild, our threat researchers have identified three distinct attack clusters, each with unique tradecraft and objectives. We first observed SharePoint exploitation on July 17, two days before Microsoft’s official advisory. 🧵 What’s happening: – The three unique attacker clusters are targeting tech, critical infrastructure and architecture and engineering firms – Two clusters deployed webshells designed to execute commands or collect sensitive system information. Another operated filelessly. – PoC code is now public. Broader exploitation is expected. 🛠️ Why it matters: “ToolShell” is trivial to exploit, stealthy, and lets attackers gain persistent access to valuable environments. SharePoint’s role as a data store and delivery mechanism makes it a high-value target. 📌 Go deeper ➡️ https://s1.ai/toolshell - Timeline of in-the-wild exploitation - Technical deep dive on all three TTP clusters - Mitigation steps and IOCs - Detection & hunting queries from SentinelOne 🛡️ SentinelOne continues to monitor and assist customers.

202

1 Kommentar

🚨 Active Exploitation Alert — Microsoft SharePoint Vulnerabilities 🚨 Unit 42 has observed active exploitation of critical vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) impacting Microsoft SharePoint. Our threat brief offers a close look at the background, attack scope, and exclusive details derived from our telemetry. We also recommend following Microsoft’s mitigation guidance immediately. Dive in for our full analysis and watch for updates: https://bit.ly/4kWFkp7

223

⚠️ Russian-backed hacking group Sandworm has launched BadPilot—a massive global operation targeting high-value sectors worldwide. ➥ 8 known vulnerabilities exploited ➥ Energy, telecommunications, shipping, and government entities compromised Read the full report: https://lnkd.in/g-YzuWGz

167

1 Kommentar

📈Finance teams might be great at managing money, but can they manage cyber risk? Our latest report dives deep into how financial organizations actually perform across the MITRE ATT&CK framework. Spoiler: there’s room to level up. Discover where the sector’s strengths lie, and where critical gaps still exist. Download the full report: https://okt.to/gbCfIu #CyberSecurity #FinanceSecurity #ThreatDetection #MITREATTACK #HackTheBox #CyberResilience #Report

90

3 Kommentare

🎯 Threat Intelligence for Pentesting & Red Teaming 🛡️ How can threat intelligence enhance penetration testing and red teaming efforts? SOCRadar’s latest blog explores how security teams can leverage real-time intelligence to strengthen offensive security strategies. 🔍 Identifying Real-World Threats: Use up-to-date intelligence on active attack techniques. 🛠️ Simulating Advanced Threats: Improve red team exercises with TTPs used by real adversaries. 🚀 Proactive Defense: Strengthen security by testing defenses against emerging cyber threats. Threat intelligence bridges the gap between offense and defense, making security testing more realistic and impactful. Learn how your team can integrate TI into red teaming. 💡 Read the full analysis: https://lnkd.in/dNc7t6tF 👉 How does your team incorporate threat intelligence into security testing? Let’s discuss in the comments. #CyberSecurity #ThreatIntelligence #RedTeam #Pentesting #SOCRadar

22

Collaborative threat intelligence enhances security by pooling expertise, resources, and insights from diverse sources. Information Sharing and Analysis Centers (ISACs) — such as the Financial Services ISAC (FS-ISAC) and Health-ISAC — have shown how effective these partnerships can be (when organizations actively participate). By facilitating real-time sharing of actionable intelligence, ISACs improve threat detection and accelerate response times. Read the blog. https://lnkd.in/e7ZjmTgb Learn more about ISASCs here National Council of ISACs. #criticalinfrastructure #informationsharing #healthit

16

Kudos to our Penetration Testing Team! 🎉   Once again, they have demonstrated their expertise and sharp skills by uncovering a Reflected Cross-Site Scripting (XSS) vulnerability in the phpIPAM product. This vulnerability has been officially registered with MITRE and assigned the identifier CVE-2024-55093 under the Common Vulnerabilities and Exposures (CVE®) Program. 🛡️ The issue stems from insufficient input validation and encoding, allowing attackers to inject malicious scripts into users’ browsers. If exploited, this could lead to session hijacking, exposure of sensitive data, and other security risks. For more details, check out the following resources: CVE: Common Vulnerabilities and Exposures 👉 https://lnkd.in/dbz_bva5 NVD - CVE-2024-55093 👉 https://lnkd.in/dbz_bva5 Bugfix: XSS - Reflected in install scripts · phpipam/phpipam@d0caaeb · GitHub 👉https://lnkd.in/dz7CYBh3

77

1 Kommentar

The true danger of “Rogue RDP” lies in the con, not the code. 👤 Back in October 2024, Google Threat Intelligence Group observed a novel phishing campaign targeting European government and military organizations by using signed .rdp attachments to establish Remote Desktop Protocol (RDP) connections. Dive into Google Threat Intelligence Group’s findings in our blog post ➡️ https://bit.ly/43zNgG3

61