tag: Endpoint · 5 items
- Engineer — Learn: ClickFix abuses clipboard/paste UI to trick users into running malicious commands; worth understanding to inform developer guidance and hardening of endpoint policies, but no patch or config change required.
- SOC/IR — Plan: ClickFix is a growing initial-access technique worth building detections for — hunt for suspicious PowerShell or cmd execution triggered from browser/clipboard context, and review CrowdStrike’s behavioral indicators.
- Leader — Skip
- Engineer — Act: All three CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation: patch Chrome for CVE-2026-85046 and CVE-2026-87491, and apply the Windows ALPC patch for CVE-2026-85880 immediately — every endpoint running Chrome on Windows is in scope.
- SOC/IR — Act: Nation-state actor UTA0565 is actively deploying CLEANGULP via drive-by fake websites; hunt for CLEANGULP IOCs across endpoints, review proxy/DNS logs for suspicious domains active around September 3–4, and tune detections for anomalous Windows ALPC activity triggered from browser processes.
- Leader — Act: A Chinese nation-state actor is weaponizing a three-CVE chain against Chrome and Windows — software present on virtually every enterprise endpoint — with all three CVEs CISA KEV-listed; confirm with engineering that the patch cycle is complete and brief leadership if your sector is a known UTA0565 target.
- Signals: CVE-2026-85046 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-85880 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-87491 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Learn: No CVE or patch involved — attackers are abusing a legitimate admin tool’s functionality. Review whether Faronics Deploy is in your environment and whether its deployment permissions are appropriately scoped.
- SOC/IR — Act: Hunt for unexpected ScreenConnect installations originating from Faronics Deploy processes; build detections for remote-management tool deployments not initiated by IT change management workflows.
- Leader — Skip
- Engineer — Plan: If Windows Defender crashes were affecting endpoint coverage in your environment, apply the follow-on fix via Windows Update to restore stable antivirus operation.
- SOC/IR — Plan: Verify that EDR/Defender telemetry gaps didn’t occur during the crash window; confirm detection coverage was restored after the fix is applied.
- Leader — Skip
- Engineer — Learn: ACR Stealer targets browser-stored credentials and tokens — review whether your CI/CD pipelines or developer workstations enforce short-lived tokens and MFA to limit blast radius if credentials are harvested.
- SOC/IR — Act: Microsoft is actively observing this campaign; hunt for ACR Stealer IOCs across EDR telemetry and SIEM, and tune detections for credential-access behaviors (browser credential dumping, token theft) across enterprise endpoints.
- Leader — Plan: A confirmed surge targeting enterprise customers elevates infostealer risk on your risk register; consider briefing on phishing-resistant MFA adoption and reviewing credential hygiene posture this quarter.