tag: Persistence · 5 items
- Engineer — Learn: No CVEs or patchable components identified; this is a post-breach persistence tool, not a vulnerability in software engineers typically run. Understanding long-term access techniques can inform detection instrumentation in logging pipelines.
- SOC/IR — Plan: Microsoft’s technical analysis on NeedyMantis likely contains TTPs and behavioral indicators worth translating into detection rules; review the full report and develop or tune persistence-detection logic (scheduled tasks, registry run keys, lateral movement patterns) for the affected verticals.
- Leader — Skip
- Engineer — Learn: No CVE to patch, but the server-side payload decryption design defeats static analysis of artifacts — informs how macOS endpoint security and EDR controls should be evaluated for JXA-based dropper chains in your fleet.
- SOC/IR — Plan: Build or tune macOS detections for JXA dropper execution and multi-stage persistence mechanisms using the Jamf Threat Labs analysis; server-side decryption means behavioral detection at runtime matters more than file-hash matching.
- Leader — Skip
- Engineer — Learn: Novel post-compromise persistence technique that abuses Chromium’s Secure Preferences to silently inject malicious extensions — no active exploitation signals, but informs browser hardening strategy: audit enterprise extension allowlists and monitor Secure Preferences file integrity.
- SOC/IR — Plan: New persistence TTP worth adding detection coverage for this quarter: build hunts for unexpected modifications to Chrome/Edge Secure Preferences files and unauthorized extension injection outside the Web Store on managed endpoints, mapping to ATT&CK T1176.
- Leader — Skip
- Engineer — Plan: Any Linux device with Telnet exposed and weak credentials is a candidate target; audit your estate for Telnet listeners, disable them, and review hardware watchdog configurations on edge/IoT devices so defenders can’t be stymied by the reboot-on-kill mechanism.
- SOC/IR — Plan: Build or tune detections for Telnet brute-force login bursts against Linux endpoints and flag unexpected device reboots following process termination events; update IR runbooks to account for the watchdog reboot loop before attempting to kill botnet processes on compromised hosts.
- Leader — Learn: A novel DDoS botnet persistence technique that complicates incident response on Linux devices — no immediate leadership action required, but useful context if DDoS risk or IoT/edge device exposure comes up in a risk review.
- Engineer — Learn: Describes how attackers abuse the ClickOnce deployment mechanism for persistence in Windows environments — no patch or config change indicated, but worth understanding if you deploy .NET apps or manage Windows estates.
- SOC/IR — Plan: New ClickOnce-based persistence TTP with public CrowdStrike analysis — build or tune detections around ClickOnce application installations and associated scheduled tasks or registry run keys in your SIEM/EDR.
- Leader — Skip