tag: Evasion · 13 items
- Engineer — Learn: Research describing how attackers can decompose and aggregate requests to evade LLM safety classifiers is relevant for teams building AI safety pipelines; no patch or configuration action is indicated by the available signals.
- SOC/IR — Learn: Interesting evasion technique, but no IOCs, ATT&CK-mapped TTPs, or active campaign signals are present — nothing to hunt or tune detections against right now.
- Leader — Learn: Useful context on fundamental limitations of LLM safety controls for organizations deploying AI products; relevant to AI governance policy discussions but does not require near-term action.
- Engineer — Learn: Novel delivery variant pre-fetches script payloads into browser cache disguised as image files, bypassing endpoint execution controls — no patch exists, but worth reviewing endpoint script-execution policies and browser isolation configurations.
- SOC/IR — Plan: New evasion technique shifts ClickFix from remote download to cache-resident payload execution; build or tune detections for unexpected script execution originating from browser cache directories, and hunt for suspicious PNG-typed files in cache that match script signatures.
- Leader — Skip
- Engineer — Learn: No CVE to patch, but the server-side payload decryption design defeats static analysis of artifacts — informs how macOS endpoint security and EDR controls should be evaluated for JXA-based dropper chains in your fleet.
- SOC/IR — Plan: Build or tune macOS detections for JXA dropper execution and multi-stage persistence mechanisms using the Jamf Threat Labs analysis; server-side decryption means behavioral detection at runtime matters more than file-hash matching.
- Leader — Skip
- Engineer — Learn: Relevant if your organization develops or distributes Android banking apps; the work-profile sandboxing abuse is a novel evasion technique worth factoring into mobile app integrity checks and attestation logic.
- SOC/IR — Learn: No IOCs or ATT&CK mappings are surfaced in this item, but the work-profile evasion mechanism is useful context for analysts triaging mobile endpoint alerts or evaluating MDM telemetry gaps.
- Leader — Skip
- Engineer — Learn: ASCII smuggling with invisible Unicode is a useful technique to understand when evaluating email security tooling or building internal phishing-resistant workflows; no patch or configuration change required today.
- SOC/IR — Plan: Add detection coverage for invisible Unicode characters in email bodies and subject lines — tune existing email security filters to flag or quarantine messages containing high-density non-printing Unicode codepoints, and build a hunt query against recent inbound mail logs for this pattern.
- Leader — Skip
- Engineer — Plan: Audit email security gateway and filtering pipeline for Unicode normalization support; configure rules to strip or flag invisible Unicode tag characters (U+E0000 block) before keyword matching, as current filter logic may silently pass these.
- SOC/IR — Act: Active high-volume campaign with a specific, huntable TTP: query recent inbound email logs for messages containing invisible Unicode tag characters interleaved within financial keywords; tune SEG/SIEM detections to flag this pattern going forward.
- Leader — Learn: Novel evasion technique shows email filtering products may have a systematic blind spot around Unicode normalization; useful context when next reviewing email security vendor capabilities or during security questionnaire assessments.
- Engineer — Learn: Silver Fox’s technique of bundling a backdoor inside a legitimately-signed application and relying on user-added AV exclusions to stay resident is a design reminder to enforce allowlisting policies and audit AV exclusion lists across managed endpoints, but no direct cloud/app patch action follows from this report.
- SOC/IR — Plan: The evasion pattern — malware sheltered under a trusted signed process in a user-granted AV exclusion — is worth building a detection for: create or tune rules to alert on AV exclusion additions for unusual signed binaries and look for ValleyRAT IOCs once Kaspersky publishes them; no IOCs are available in this report to sweep against today.
- Leader — Learn: Silver Fox’s use of signed software to bypass endpoint controls illustrates how attacker-signed supply-chain lures undermine trust models; useful context for future board discussions on endpoint policy, but no same-week leadership action is warranted given no confirmed enterprise-sector targeting or widely-used vendor exposure.
- Engineer — Skip
- SOC/IR — Learn: The analysis of polymorphic phishing page behavior — including how the page mutates and occasionally self-breaks — offers useful context for tuning detection logic around evasive phishing infrastructure, but there are no IOCs or detections provided here.
- Leader — Skip
- Engineer — Learn: Highlights that string-matching or IP blocklists for SSRF protection (e.g. blocking ‘169.254.169.254’) can be bypassed via hostname equivalents — review your SSRF defenses to ensure they resolve hostnames before comparing, not just match raw strings.
- SOC/IR — Learn: Useful context for tuning SSRF-related detections: logs showing hostname variants of link-local or metadata addresses in outbound requests may indicate bypass attempts worth adding to hunt queries.
- Leader — Skip
- Engineer — Learn: DOUBLECUP embeds payloads inside PNG files as an obfuscation layer rather than true steganography; worth understanding the technique when reviewing file-upload handling and egress filtering in your pipelines, but no patch or config change is required today.
- SOC/IR — Learn: The write-up surfaces a payload-delivery method using PNG files, which could inform tuning detections around suspicious image-file execution chains; however, the summary is too truncated to extract IOCs or a concrete detection rule — monitor the full SANS diary for actionable indicators.
- Leader — Skip
- Engineer — Learn: Attackers are masking vulnerability scans behind AI bot user-agents to evade rate-limiting and WAF rules that allowlist crawlers; review whether your WAF/edge allows AI bot UAs without scrutiny and consider tightening controls.
- SOC/IR — Plan: Build or tune detections to flag AI crawler user-agents (e.g. ClaudeBot, GPTBot) associated with high request rates or vulnerability-scanning patterns; hunt web access logs for these UAs performing non-crawl behavior since this technique is actively in use.
- Leader — Skip
- Engineer — Learn: BYOVD and Process Ghosting are sophisticated defense-evasion techniques that challenge standard EDR assumptions; no patch action available, but useful for evaluating EDR coverage and hardening kernel driver allow-listing policies.
- SOC/IR — Plan: Multiple unrelated threat clusters adopting Cruciferra makes this detection-relevant — build or tune detections for known vulnerable driver loads (BYOVD) and process ghosting behaviors in your EDR; no IOCs surfaced yet so immediate hunting isn’t actionable.
- Leader — Skip
- Engineer — Learn: Comment stuffing in HTML attachments is a novel obfuscation technique worth understanding when tuning email security tooling or evaluating AI-based scanning products; no patch or config change required.
- SOC/IR — Plan: Build or tune email-gateway detections to flag HTML attachments with abnormally high comment-to-content ratios, as this technique is designed specifically to bypass AI-based filters your stack may rely on.
- Leader — Skip