CuraSec

tag: Defense-Evasion · 3 items

Learn archived Linux Backdoors Impersonate Email Processes to Evade Detection
2026-10-08 · The Hacker News · source ↗ #linux#defense-evasion#network-appliances
  • Engineer — Learn: No exploitation signals or KEV listing, but the technique of naming malicious binaries after legitimate OS components is relevant for engineers auditing Linux network appliances; worth reviewing process inventories on edge devices for unexpected email-named processes.
  • SOC/IR — Learn: The evasion pattern — malware traffic masquerading as email service traffic — is a useful triage signal, but the summary provides no IOCs or ATT&CK-mapped TTPs actionable enough to build detections; track for a fuller technical write-up before writing rules.
  • Leader — Skip
Plan archived BigDiskBuster PoC Blocks Defender Updates via Disk Exhaustion
2026-09-24 · The Hacker News · source ↗ #zero-day#defense-evasion#microsoft-defender
  • Engineer — Plan: Public PoC on GitHub means this disk-exhaustion denial-of-defense technique is accessible to attackers now; no patch exists, so implement disk-space monitoring and alerting on Defender signature/platform update failures as a compensating control on Windows endpoints.
  • SOC/IR — Plan: This technique maps to ATT&CK T1562 (Impair Defenses) and could leave endpoints running stale signatures undetected; build a detection correlating sudden disk-space consumption with Defender update failure events, and add Defender update staleness to your alert baseline.
  • Leader — Learn: A PoC that can silently stall AV signature updates highlights a defense-in-depth gap, but with no active exploitation or vendor patch it doesn’t require leadership action this week; useful context for conversations about monitoring coverage and compensating controls.
Plan archived REVSTEALER Drops 4 Persistent Modules to Kill Defender and Mine Crypto
2026-09-06 · The Hacker News · source ↗ #windows-malware#defense-evasion#crypto-mining
  • Engineer — Learn: Elastic documents a novel persistence pattern where the initial stealer self-deletes but leaves behind four modules (ProManager, WinUpdate, SoftManager, +1) that disable Defender and Windows Update before mining crypto; no exploitation signals, but the defense-bypass design informs endpoint hardening strategy.
  • SOC/IR — Plan: Build or tune detections for the named module artifacts (ProManager, WinUpdate, SoftManager) and hunt for Windows Update / Defender service-disablement events paired with subsequent outbound crypto-mining traffic; check Elastic’s published research for YARA rules and ATT&CK mappings.
  • Leader — Skip