See Your Attack Surface Before Adversaries Do.

PowerShell

[UNC-2026] Adversaries are increasingly utilizing PowerShell scripts to automate malicious code execution within compromised enterprise environments.

Process Injection

[APT-99] Threat actors are employing process injection to execute arbitrary code within the address space of separate live processes to evade detection.

Steganography

[UNC-4492] Recent campaigns have been observed hiding command and control traffic within digital images to bypass network security monitoring.

Protocol or Service Impersonation

[APT-12] State-aligned actors are impersonating legitimate web service traffic to disguise malicious communication channels.

Phishing

[UNC-8821] Increased use of sophisticated phishing lures is leading users to execute attacker-controlled actions in cloud-based environments.

Exploit Public-Facing Application

[APT-55] Adversaries are actively exploiting vulnerabilities in public-facing web applications to gain initial entry into corporate networks.

Kerberoasting

[UNC-3030] Observed activity shows actors requesting service tickets to perform offline brute-force attacks against service account passwords.

Data Encrypted for Impact

[UNC-7712] Ransomware operators are deploying encryption routines at an increased rate, contributing to a significant rise in global extortion incidents.

Web Protocols

[APT-412] Threat actors are leveraging standard web protocols to blend malicious command and control traffic with legitimate user activity.

Obfuscated Files or Information

[UNC-1092] Adversaries are using advanced obfuscation techniques on malicious payloads to hinder static analysis by security tools.

PowerShell

[UNC-2026] Adversaries are increasingly utilizing PowerShell scripts to automate malicious code execution within compromised enterprise environments.

Process Injection

[APT-99] Threat actors are employing process injection to execute arbitrary code within the address space of separate live processes to evade detection.

Steganography

[UNC-4492] Recent campaigns have been observed hiding command and control traffic within digital images to bypass network security monitoring.

Protocol or Service Impersonation

[APT-12] State-aligned actors are impersonating legitimate web service traffic to disguise malicious communication channels.

Phishing

[UNC-8821] Increased use of sophisticated phishing lures is leading users to execute attacker-controlled actions in cloud-based environments.

Exploit Public-Facing Application

[APT-55] Adversaries are actively exploiting vulnerabilities in public-facing web applications to gain initial entry into corporate networks.

Kerberoasting

[UNC-3030] Observed activity shows actors requesting service tickets to perform offline brute-force attacks against service account passwords.

Data Encrypted for Impact

[UNC-7712] Ransomware operators are deploying encryption routines at an increased rate, contributing to a significant rise in global extortion incidents.

Web Protocols

[APT-412] Threat actors are leveraging standard web protocols to blend malicious command and control traffic with legitimate user activity.

Obfuscated Files or Information

[UNC-1092] Adversaries are using advanced obfuscation techniques on malicious payloads to hinder static analysis by security tools.