tag: Living-Off-the-Land · 6 items
- Engineer — Learn: The focus on legitimate-tool abuse and M365 session hijacking is worth understanding for defensive architecture, but the summary provides no specific CVE, misconfiguration, or patch target to act on.
- SOC/IR — Learn: A ranked threat-technique overview could sharpen triage priorities, but the summary names no specific TTPs, IOCs, or ATT&CK mappings — read the full report before deciding whether any detections warrant tuning.
- Leader — Skip
- Engineer — Learn: The growing trend of legitimate RMM tools weaponized for unauthorized access is worth factoring into software inventory and access-control design, but no specific tool, CVE, or patch is identified in this entry to act on.
- SOC/IR — Plan: Prioritize building or tuning detections for unexpected RMM tool deployments (ScreenConnect and others) across the estate — review process creation and network telemetry for tools outside your approved list.
- Leader — Skip
- Engineer — Learn: No CVE or patch surface here, but the technique of tunneling C2 through legitimate Microsoft cloud services (Outlook/OneDrive APIs) is worth understanding when designing network egress controls and M365 API monitoring.
- SOC/IR — Plan: The Outlook/OneDrive C2 pattern is a detection-engineering opportunity — build or tune rules for anomalous Microsoft Graph API calls (unexpected mail-item access, atypical OneDrive polling patterns) that could surface this TTP in your estate this quarter.
- Leader — Learn: China-nexus espionage targeting government and policy organizations across Asia; relevant for sector threat-awareness briefings but no immediate action required unless your organization operates in the targeted geographies or policy verticals.
- Engineer — Learn: No patch or configuration change required; this is a technique highlight showing attackers deploy legitimate RMM clients to blend in. Worth auditing your estate for unauthorized ScreenConnect installations and confirming it appears only where IT-sanctioned.
- SOC/IR — Plan: Build or tune detections for ScreenConnect client processes spawning in unexpected contexts (non-IT endpoints, unusual parent processes, new installs outside change windows); review your SIEM for ScreenConnect relay connections to external infrastructure.
- Leader — Skip
- Engineer — Plan: No exploitable CVE here, but the tactic relies on uncontrolled RMM installs reaching endpoints; audit endpoints for unauthorized MSP360 or ScreenConnect installations and enforce an allowlist policy for approved RMM tools via EDR or software-control policy.
- SOC/IR — Plan: The dual-RMM pattern (MSP360 dropping ScreenConnect) is a concrete detection target; build or tune rules to alert on MSP360 installations from non-IT asset-management contexts and correlate with ScreenConnect process spawns, and hunt for both tools installed since September 2026.
- Leader — Learn: The campaign illustrates a maturing trend of threat actors using legitimate RMM tools to bypass controls; worth noting for the next review of acceptable-use and third-party remote-access policy, but no immediate board-level action required absent evidence of a breach in your sector.
- Engineer — Plan: Node.js is ubiquitous across cloud workloads, CI/CD pipelines, and servers, making node.exe a high-value abuse target; review execution controls and implement monitoring to flag unexpected node.exe process trees or outbound connections in your environments this quarter.
- SOC/IR — Act: Active campaign targeting government, tech, and hospitality sectors since February 2026 — hunt for anomalous node.exe execution (unexpected parent processes, suspicious child spawns, outbound network from node.exe) in EDR telemetry back to February, and pull the full Symantec Threat Hunter report for any published IOCs to sweep against SIEM logs.
- Leader — Learn: Attackers are weaponizing trusted developer runtimes to evade controls — a useful data point for understanding how the threat landscape is evolving, but no immediate leadership action is required absent a specific vendor breach or sector-level systemic event.