tag: Detection · 5 items
- Engineer — Learn: Research on AI-authored malware and agentic execution techniques is worth reviewing to understand how these threats interact with build/CI environments, but no exploited CVEs or supply-chain IOCs are present requiring immediate action.
- SOC/IR — Plan: Unit 42’s analysis of AI-enabled malware TTPs — including brand abuse lures and agentic execution chains — is worth translating into behavioral detection tuning this quarter; review the report for any new evasion patterns to add to endpoint analytics rules.
- Leader — Learn: This report provides useful benchmarking data on the maturation of AI-assisted threats, suitable for future board deck context on the AI threat landscape, but requires no immediate leadership action.
- Engineer — Learn: Practical reminder that cloud identity login logs (Entra ID sign-in logs) deserve the same daily scrutiny as on-prem logs; useful if you haven’t wired these into a monitoring workflow yet, but no patch or config change required.
- SOC/IR — Plan: Adopt or adapt the PowerShell queries shown to pull Entra successful/failed login data for routine password-spray hunting; worth scheduling as a log-source coverage improvement if Entra sign-in logs aren’t already feeding your SIEM.
- Leader — Skip
- Engineer — Learn: Research on automated SSH attack timelines underscores why key-only auth, login alerting, and session monitoring must be in place before an attacker lands — no specific patch needed, but validates hardening posture on any SSH-exposed host.
- SOC/IR — Plan: The ~22-second login-to-persistence window is a concrete benchmark: review SSH authentication alert latency in your SIEM and ensure post-login activity (new cron jobs, authorized_keys writes, shell spawns) triggers faster than that window closes.
- Leader — Skip
- Engineer — Learn: Browser-level, technique-based phishing detection is a useful design principle to evaluate when assessing IdP or SSO defenses, but no specific CVE or configuration change is required today.
- SOC/IR — Plan: Evaluate whether current phishing detections rely heavily on domain blocklists and investigate adding technique-based behavioral signals (e.g., credential-harvest page patterns) to supplement IOC-driven coverage.
- Leader — Learn: Useful framing for a board conversation about why threat intelligence investments have diminishing returns against AI-assisted phishing — relevant for future budget and vendor evaluation discussions.
- Engineer — Plan: Audit egress firewall rules to block or alert on outbound connections to raw IPs (not resolved via internal DNS); this is a concrete hardening step supported by the finding.
- SOC/IR — Plan: Build or tune detections for outbound traffic to bare IP addresses without preceding DNS resolution — this pattern is a high-signal C2 indicator worth adding to your SIEM hunting queries.
- Leader — Skip