tag: C2 · 10 items
- Engineer — Learn: AvisLoader’s ClickFix delivery technique is a social-engineering vector worth understanding when hardening endpoint policies and user-facing workflows, but no patch or configuration action is required — no KEV, PoC, or exploitation signals present.
- SOC/IR — Plan: The documented TTPs — ClickFix lure delivery, shortcut-based persistence, encrypted P2P C2 — are ATT&CK-mappable and worth translating into Sigma/KQL detections for LNK abuse and anomalous P2P traffic patterns this quarter; no published IOCs yet to sweep on immediately.
- Leader — Skip
- Engineer — Learn: No CVE or patch surface here, but the technique of tunneling C2 through legitimate Microsoft cloud services (Outlook/OneDrive APIs) is worth understanding when designing network egress controls and M365 API monitoring.
- SOC/IR — Plan: The Outlook/OneDrive C2 pattern is a detection-engineering opportunity — build or tune rules for anomalous Microsoft Graph API calls (unexpected mail-item access, atypical OneDrive polling patterns) that could surface this TTP in your estate this quarter.
- Leader — Learn: China-nexus espionage targeting government and policy organizations across Asia; relevant for sector threat-awareness briefings but no immediate action required unless your organization operates in the targeted geographies or policy verticals.
- Engineer — Learn: Novel technique of abusing legitimate iCloud calendar infrastructure as a command-and-control channel; no KEV, PoC, or active exploitation signals, but worth understanding for macOS fleet defenders designing egress controls around trusted Apple services.
- SOC/IR — Plan: Build or tune detections for macOS processes making anomalous iCloud Calendar API calls (calendar.google.com analogue: p-calendarws.icloud.com) or reading public calendar events at unusual intervals — this C2 pattern will evade domain blocklists targeting known C2 infrastructure.
- Leader — Skip
- Engineer — Learn: MQTT-as-C2 is a novel evasion technique worth understanding when designing network egress controls — consider whether MQTT traffic on port 1883/8883 to external brokers is permitted in your environment. No KEV listing, PoC, or evidence of exploitation outside Asia/South America campaigns.
- SOC/IR — Plan: MQTT is rarely monitored in enterprise SIEMs, making it an effective detection gap; add a hunt for unexpected outbound MQTT connections (ports 1883/8883) to external broker IPs as a low-cost coverage improvement this quarter. No IOCs were published in the disclosed research.
- Leader — Skip
- Engineer — Learn: MQTT as a C2 channel is an emerging evasion technique worth noting for threat modeling — if you run MQTT brokers or IoT infrastructure, review whether outbound MQTT to external brokers is permitted and consider blocking or monitoring it.
- SOC/IR — Plan: Build or tune detections for MQTT (port 1883/8883) traffic from endpoints to external brokers as a C2 indicator; the summary lacks published IOCs, but MQTT is not typically monitored in most SIEM/EDR rulesets and this framework’s activity dates to 2023.
- Leader — Skip
- Engineer — Learn: No exploitation signals or patch action required, but this technique highlights the risk of trusting M365 egress unconditionally; review whether SharePoint/Teams API access from non-user contexts is logged and anomaly-monitored in your environment.
- SOC/IR — Plan: TWINLOOT’s C2-over-SharePoint-Online pattern blends into legitimate M365 traffic — build or tune detections for unusual SharePoint file polling cadence and Teams API calls from non-interactive service contexts to catch implants using this framework.
- Leader — Learn: Newly documented implant class that weaponizes trusted M365 services, useful context for future conversations about M365 security controls and monitoring investment, but no confirmed active campaigns require immediate leadership action.
- Engineer — Plan: Audit egress firewall rules to block or alert on outbound connections to raw IPs (not resolved via internal DNS); this is a concrete hardening step supported by the finding.
- SOC/IR — Plan: Build or tune detections for outbound traffic to bare IP addresses without preceding DNS resolution — this pattern is a high-signal C2 indicator worth adding to your SIEM hunting queries.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: New malware cluster (TELESHIM, MIXEDKEY, BINDCLOAK) using Telegram as C2 channel is worth tracking for detection coverage, but no IOCs or ATT&CK mappings are provided in the current reporting — revisit when Zscaler publishes technical indicators.
- Leader — Learn: East Asian threat actor targeting Middle East government entities with novel tooling; relevant for sector awareness but no vendor exposure or regulatory trigger for a US/global enterprise leader.
- Engineer — Learn: Novel living-off-the-land C2 technique abusing legitimate Microsoft Graph calendar APIs to blend into normal M365 traffic; no patch exists but worth reviewing M365 conditional-access and app-permission scopes to limit blast radius of compromised accounts.
- SOC/IR — Plan: Build or tune detection for anomalous Graph API calendar activity (unexpected event creation, unusual read patterns from non-user agents) in M365 audit logs; no published IOCs yet, but the TTP is concrete enough to start a detection rule in Sentinel or Elastic against Graph audit data.
- Leader — Learn: Illustrates how attackers leverage licensed SaaS infrastructure to evade network-level controls; useful context for future budget conversations around M365 audit-log retention and cloud SIEM coverage, but no immediate leadership action required.
- Engineer — Learn: gRPC-based C2 may evade TLS inspection tuned for HTTP/2 REST traffic; review whether your egress controls decode and inspect gRPC streams.
- SOC/IR — Plan: Build or tune detections for outbound gRPC streaming to novel external endpoints; Silver Fox distributes via SEO-poisoned counterfeit installers, so hunt for unexpected Rust-compiled binaries in user-facing application paths.
- Leader — Learn: Adds to the picture of China-linked actors targeting enterprise software supply chains via SEO poisoning; useful context for board-level threat landscape briefings but no immediate action required.