Powershell on CuraSec

TerminalFix ClickFix variant lures users into running PowerShell via fake CAPTCHA

Tue, 01 Sep 2026 15:28:52 +0000

Engineer — Learn: No patchable CVE — this is a user-execution social engineering chain. Evaluate whether your environment enforces PowerShell Constrained Language Mode or WDAC policies that would limit blast radius if a user runs attacker-supplied terminal commands.
SOC/IR — Plan: Build or tune detections for PowerShell processes spawned from browser-related parent processes, and alert on known reverse-tunnel binaries (chisel, ngrok, etc.); the ClickFix TTP pattern is well-documented and Sigma rules exist to template from.
Leader — Learn: Active campaign exploiting user behavior rather than software flaws; useful context for refreshing security awareness training around CAPTCHA-themed lures, but no board-level action is warranted without wider impact data.

Sun, 30 Aug 2026 15:19:58 +0000

Engineer — Learn: Novel ClickFix variant redirecting victims to Windows Terminal/PowerShell rather than the Run dialog increases execution success for complex payloads; no patch applies, but this is a good prompt to verify PowerShell Script Block Logging and AMSI are enabled and that AppLocker/WDAC policies restrict terminal abuse.
SOC/IR — Plan: Build or tune detections for browser or web-content processes spawning Windows Terminal/PowerShell children that then launch reverse-tunnel tooling; also baseline and alert on known tunnel binaries (ngrok, frp, chisel) appearing post-user-session, since no IOCs are published yet to support an immediate hunt.
Leader — Learn: Awareness of this technique evolution is useful background for refreshing phishing/social-engineering guidance in security awareness programs, but it does not require a leadership statement or risk-register update at this time.

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical walkthrough on using MS Graph and PowerShell to surface Entra ID risk detections — useful reference if you’re building automated triage or identity monitoring pipelines.
SOC/IR — Plan: Walk through the MS Graph risk-detection commands shown here and consider incorporating them into your Entra ID hunting runbooks or SIEM enrichment workflows.
Leader — Skip

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical scripting technique for auditing MFA coverage gaps in Entra ID using Microsoft.Graph.Beta PowerShell; useful reference when validating rollout completeness but no vulnerability or patch action required.
SOC/IR — Skip
Leader — Skip

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical walkthrough of Microsoft Graph API v2 for M365/Entra identity hygiene — useful for building internal scripts to surface stale accounts and over-licensed users, but no vulnerability or exploitation pressure requiring immediate action.
SOC/IR — Learn: Familiarity with Microsoft Graph queries is useful context for hunting lateral movement via stale or dormant accounts, but this tutorial yields no immediate detection rule or IOC to act on.
Leader — Skip

Mon, 13 Jul 2026 13:18:50 +0000

Engineer — Learn: No vulnerability to patch here — this is a reconnaissance TTP story showing adversaries using AI-generated scripts for AD discovery. Useful context for understanding how attacker tooling is evolving, but no configuration or software change required today.
SOC/IR — Plan: The enumeration pattern — PowerShell querying DC, mapping users/computers/domains, exporting results to a directory, and generating AD_Report.html — is a detectable behavior signature; review PowerShell Script Block Logging coverage and build or tune a Sigma/KQL rule for this AD bulk-export pattern this quarter.
Leader — Learn: Demonstrates that AI tooling is lowering the skill floor for AD reconnaissance, a useful data point for board-level narratives about AI accelerating attacker capability; no immediate leadership action required.