tag: Evasion · 7 items
- Engineer — Learn: Silver Fox’s technique of bundling a backdoor inside a legitimately-signed application and relying on user-added AV exclusions to stay resident is a design reminder to enforce allowlisting policies and audit AV exclusion lists across managed endpoints, but no direct cloud/app patch action follows from this report.
- SOC/IR — Plan: The evasion pattern — malware sheltered under a trusted signed process in a user-granted AV exclusion — is worth building a detection for: create or tune rules to alert on AV exclusion additions for unusual signed binaries and look for ValleyRAT IOCs once Kaspersky publishes them; no IOCs are available in this report to sweep against today.
- Leader — Learn: Silver Fox’s use of signed software to bypass endpoint controls illustrates how attacker-signed supply-chain lures undermine trust models; useful context for future board discussions on endpoint policy, but no same-week leadership action is warranted given no confirmed enterprise-sector targeting or widely-used vendor exposure.
- Engineer — Skip
- SOC/IR — Learn: The analysis of polymorphic phishing page behavior — including how the page mutates and occasionally self-breaks — offers useful context for tuning detection logic around evasive phishing infrastructure, but there are no IOCs or detections provided here.
- Leader — Skip
- Engineer — Learn: Highlights that string-matching or IP blocklists for SSRF protection (e.g. blocking ‘169.254.169.254’) can be bypassed via hostname equivalents — review your SSRF defenses to ensure they resolve hostnames before comparing, not just match raw strings.
- SOC/IR — Learn: Useful context for tuning SSRF-related detections: logs showing hostname variants of link-local or metadata addresses in outbound requests may indicate bypass attempts worth adding to hunt queries.
- Leader — Skip
- Engineer — Learn: DOUBLECUP embeds payloads inside PNG files as an obfuscation layer rather than true steganography; worth understanding the technique when reviewing file-upload handling and egress filtering in your pipelines, but no patch or config change is required today.
- SOC/IR — Learn: The write-up surfaces a payload-delivery method using PNG files, which could inform tuning detections around suspicious image-file execution chains; however, the summary is too truncated to extract IOCs or a concrete detection rule — monitor the full SANS diary for actionable indicators.
- Leader — Skip
- Engineer — Learn: Attackers are masking vulnerability scans behind AI bot user-agents to evade rate-limiting and WAF rules that allowlist crawlers; review whether your WAF/edge allows AI bot UAs without scrutiny and consider tightening controls.
- SOC/IR — Plan: Build or tune detections to flag AI crawler user-agents (e.g. ClaudeBot, GPTBot) associated with high request rates or vulnerability-scanning patterns; hunt web access logs for these UAs performing non-crawl behavior since this technique is actively in use.
- Leader — Skip
- Engineer — Learn: BYOVD and Process Ghosting are sophisticated defense-evasion techniques that challenge standard EDR assumptions; no patch action available, but useful for evaluating EDR coverage and hardening kernel driver allow-listing policies.
- SOC/IR — Plan: Multiple unrelated threat clusters adopting Cruciferra makes this detection-relevant — build or tune detections for known vulnerable driver loads (BYOVD) and process ghosting behaviors in your EDR; no IOCs surfaced yet so immediate hunting isn’t actionable.
- Leader — Skip
- Engineer — Learn: Comment stuffing in HTML attachments is a novel obfuscation technique worth understanding when tuning email security tooling or evaluating AI-based scanning products; no patch or config change required.
- SOC/IR — Plan: Build or tune email-gateway detections to flag HTML attachments with abnormally high comment-to-content ratios, as this technique is designed specifically to bypass AI-based filters your stack may rely on.
- Leader — Skip