See Your Attack Surface Before Adversaries Do.

PowerShell

[UNC-4921] Adversaries are increasingly utilizing obfuscated PowerShell scripts to execute malicious payloads while bypassing standard security monitoring.

Process Injection

[APT-382] Observed activity involves injecting malicious code into legitimate system processes to maintain persistence and evade detection.

Steganography

[UNC-7712] Threat actors are hiding command and control instructions within image files to exfiltrate data and communicate with C2 servers.

Protocol or Service Impersonation

[APT-902] Adversaries are masking malicious traffic by mimicking legitimate web service protocols to thwart network analysis efforts.

Spearphishing Attachment

[UNC-1029] Recent campaigns utilize weaponized documents to deliver secondary loaders, leading to widespread ransomware deployment.

Windows Command Shell

[APT-554] Actors are leveraging native Windows command shells to execute post-exploitation reconnaissance commands in compromised environments.

Data Obfuscation

[UNC-3304] Adversaries are adding meaningless data to C2 protocols to prevent security tools from decoding and analyzing malicious traffic.

Golden Ticket

[APT-219] Observed actors are targeting domain controllers to forge Kerberos tickets, enabling long-term unauthorized access to network resources.

Web Protocols

[UNC-8821] Threat actors are using standard HTTP/HTTPS requests to communicate with external infrastructure, blending in with normal web traffic.

Exfiltration to Cloud Storage

[APT-440] Adversaries are abusing legitimate cloud storage services to exfiltrate sensitive organizational data during ransomware operations.

PowerShell

[UNC-4921] Adversaries are increasingly utilizing obfuscated PowerShell scripts to execute malicious payloads while bypassing standard security monitoring.

Process Injection

[APT-382] Observed activity involves injecting malicious code into legitimate system processes to maintain persistence and evade detection.

Steganography

[UNC-7712] Threat actors are hiding command and control instructions within image files to exfiltrate data and communicate with C2 servers.

Protocol or Service Impersonation

[APT-902] Adversaries are masking malicious traffic by mimicking legitimate web service protocols to thwart network analysis efforts.

Spearphishing Attachment

[UNC-1029] Recent campaigns utilize weaponized documents to deliver secondary loaders, leading to widespread ransomware deployment.

Windows Command Shell

[APT-554] Actors are leveraging native Windows command shells to execute post-exploitation reconnaissance commands in compromised environments.

Data Obfuscation

[UNC-3304] Adversaries are adding meaningless data to C2 protocols to prevent security tools from decoding and analyzing malicious traffic.

Golden Ticket

[APT-219] Observed actors are targeting domain controllers to forge Kerberos tickets, enabling long-term unauthorized access to network resources.

Web Protocols

[UNC-8821] Threat actors are using standard HTTP/HTTPS requests to communicate with external infrastructure, blending in with normal web traffic.

Exfiltration to Cloud Storage

[APT-440] Adversaries are abusing legitimate cloud storage services to exfiltrate sensitive organizational data during ransomware operations.