CuraSec

tag: Threat-Hunting · 3 items

Act Hunting MacSync Stealer infrastructure via behavioral pivots
2026-08-19 · Microsoft Security Blog · source ↗ #macos-stealer#threat-hunting#domain-pivoting
  • Engineer — Learn: MacSync Stealer targets macOS endpoints and could affect developer machines or macOS-based CI runners; no patch or configuration action exists, but understanding that this stealer rapidly rotates C2 domains should inform endpoint coverage decisions for macOS assets.
  • SOC/IR — Act: Microsoft’s analysis identifies 30+ MacSync Stealer-attributed domains via durable behavioral pivots; hunt for connections to those domains in DNS and proxy logs since the start of MacSync activity, and encode the stable behavioral signals as detections to survive future domain rotation.
  • Leader — Skip
Plan CrowdStrike Publishes ESXi Shell Command Obfuscation Hunt Methodology
2026-08-09 · CrowdStrike Blog · source ↗ #vmware-esxi#threat-hunting#shell-obfuscation
  • Engineer — Learn: Describes how threat actors obfuscate shell commands on ESXi hosts — no patch action indicated from the title alone, but useful for understanding attacker technique when designing ESXi hardening and logging posture.
  • SOC/IR — Plan: CrowdStrike’s hunting methodology for ESXi shell obfuscation is directly adoptable; schedule a review of the techniques and build or adapt hunt queries targeting ESXi command-line anomalies in your SIEM this quarter.
  • Leader — Skip
Learn archived CrowdStrike 2026 Threat Hunting Report: AI Accelerates Attacker Speed
2026-08-03 · CrowdStrike Blog · source ↗ #threat-intel#threat-hunting#ai-security
  • Engineer — Skip
  • SOC/IR — Learn: Vendor threat hunting report likely contains updated TTPs and dwell-time trends worth reviewing to calibrate hunt cadence and detection priorities, but no actionable IOCs or specific detections are signaled here.
  • Leader — Learn: High-level findings on shrinking exploitation windows and AI-driven attacker acceleration could provide useful benchmarking data for board-level risk discussions and future budget justification.