See Your Attack Surface Before Adversaries Do.

PowerShell

[UNC-9921] Adversaries are increasingly utilizing obfuscated PowerShell scripts to execute malicious payloads while bypassing standard endpoint detection mechanisms.

Process Injection

[APT-4402] Threat actors are injecting malicious code into legitimate system processes to maintain persistence and escalate privileges within compromised environments.

Steganography

[UNC-1104] Recent campaigns have been observed hiding command and control instructions within image files to evade network traffic analysis.

Protocol or Service Impersonation

[APT-8820] Actors are mimicking legitimate web service traffic to disguise malicious communication channels and thwart security monitoring efforts.

Golden Ticket

[UNC-5509] Observed activity indicates a rise in attackers targeting domain controllers to forge Kerberos tickets for persistent unauthorized access.

Spearphishing Attachment

[APT-3301] State-aligned actors are deploying highly targeted spearphishing emails containing malicious documents to facilitate initial network entry.

Web Protocols

[UNC-7742] Malware families are leveraging standard HTTP/HTTPS protocols to blend in with normal user web traffic during data exfiltration.

Data Encrypted for Impact

[UNC-2290] Ransomware operators are accelerating the encryption of critical business data to maximize pressure during extortion attempts.

Obfuscated Files or Information

[APT-1401] Threat actors are using advanced packing and obfuscation techniques to hide malicious binaries from static analysis tools.

External Remote Services

[UNC-4483] Exploitation of vulnerabilities in VPN and remote access gateways remains a primary vector for initial access in recent intrusions.

PowerShell

[UNC-9921] Adversaries are increasingly utilizing obfuscated PowerShell scripts to execute malicious payloads while bypassing standard endpoint detection mechanisms.

Process Injection

[APT-4402] Threat actors are injecting malicious code into legitimate system processes to maintain persistence and escalate privileges within compromised environments.

Steganography

[UNC-1104] Recent campaigns have been observed hiding command and control instructions within image files to evade network traffic analysis.

Protocol or Service Impersonation

[APT-8820] Actors are mimicking legitimate web service traffic to disguise malicious communication channels and thwart security monitoring efforts.

Golden Ticket

[UNC-5509] Observed activity indicates a rise in attackers targeting domain controllers to forge Kerberos tickets for persistent unauthorized access.

Spearphishing Attachment

[APT-3301] State-aligned actors are deploying highly targeted spearphishing emails containing malicious documents to facilitate initial network entry.

Web Protocols

[UNC-7742] Malware families are leveraging standard HTTP/HTTPS protocols to blend in with normal user web traffic during data exfiltration.

Data Encrypted for Impact

[UNC-2290] Ransomware operators are accelerating the encryption of critical business data to maximize pressure during extortion attempts.

Obfuscated Files or Information

[APT-1401] Threat actors are using advanced packing and obfuscation techniques to hide malicious binaries from static analysis tools.

External Remote Services

[UNC-4483] Exploitation of vulnerabilities in VPN and remote access gateways remains a primary vector for initial access in recent intrusions.