Wow, Microsoft is removing #WMIC from Windows!
But they aren't removing the underlying WMI framework, so threat actors will have to use PowerShell to access WMI.

🔗 techcommunity.microsoft.com/blog/windows...

#IncidentResponse #ThreatDetection #ThreatIntel #CSIRT #CERT

That's a bit nasty - a threat actor uses #Velociraptor as their primary C2 implant on the victim's system.

You think they might also let the victim use it for responding to the compromise as well? 😂

news.sophos.com/en-us/2025/0...

#DFIR #IncidentResponse #ThreatDetection #ThreatIntel

"I SPy" Entra ID Global Admin Escalation Technique

Datadog's Security Labs identified an abuse of Office 365 Exchange Online service principal (SP) allowing escalation to Global Admin. MSRC considers it "expected misconfiguration" so don't expect a fix.

🔗 securitylabs.datadoghq.com/articles/i-s...

This is a timely reminder to ensure any third-parties with access to your systems follow the same cyber policies you'd expect your internal staff to follow.

www.bleepingcomputer.com/news/securit...

#IncidentReponse #DataBreach #CSIRT

This is an interesting write up on a slightly different #Docker #container #malware attack from the Cado Security and Darktrace teams.

🔗 www.darktrace.com/blog/obfusca...

Here's an update on the data breach of court documents from the NSW JusticeLink website.

tl;dr - it was an individual that was able to download +9k documents over two months, it doesn't appear they were leaked anywhere publicly.

www.theguardian.com/australia-ne...

This is a really nice write up from Sekoia with lots of #ThreatDetection details, regardless of the #EDR you're using.

🔎 Of particular note, this attack is aided with a .LNK file pulling in a .HTA via a remote location.

🚨 New Critical RCE in Erlang/0TP SSH (CVSS 10)

- CVE-2025-32433
- Exploitable without authentication needed
- Exists in Erlang's built-in SSH server
- Commonly found in loT and Teleco gear
- Exploit model now in Metasploit and on GitHub

With all the talk about the use of #Signal by government officials in the US, it's worth remembering #ThreatActors will target what they need to steal the data they want.

🔗 cloud.google.com/blog/topics/...

#BYOVD attacks are slowly becoming more common for threat actors to escalate privilege and kill security tools.
Make sure you're #ThreatHunting for new Vulnerable Drivers!

#IncidentResponse #ransomware #ThreatDetection

Join me for SANS Institute #Perth Community Night today!

📋 Registration
Thurs, 13 Feb 2025
5:30pm – 6pm

🎤 Presentation
6pm – 7pm

Register Here: https://www.sans.org/mlp/community-night-perth-february-2025/

📍The Pan Pacific Perth Hotel, 207 Adelaide Terrace, Perth WA 6000

I just found this amazing repository of credential stealer system info files by #MalBeacon, along with #YARA sigs for them.
Useful to ID a cred stealer or going #ThreatHunting.

github.com/MalBeacon/wh... #threatintel #infosec #malware #DFIR

The #FBI mass-removed #PlugX #malware from infected US computers. The infections were attributed to #MustangPanda (aka #TwillTyphoon).

https://buff.ly/3PBmOpe
#IncidentResponse

#Ransomware threat actors are increasingly abusing #AWS Server-Side Encryption (SSE-C) to encrypt S3 buckets. Most recently a TA known as #Codefinger is using this technique.

🕵 Monitoring S3 & encryption activity via CloudTrail & GuardDuty.

www.halcyon.ai/blog/abusing...

#CloudForensics #FOR509