I'm not sure this will have a significant impact on what Threat Actors do with WMI, however, it'll at least force a Threat Actor to use PowerShell where there is better built-in visibility (if it's enabled), compared to WMIC.

🚨 Alert on new credentials added to SPs.
🔥 Monitor changes to federated domains (federationConfiguration).
🕵🏼‍♂️ Hunt unusual Graph API calls to /domains, /credentials, and /federationConfiguration.

#DFIR #ThreatHunting #EntraID #CloudForensics #M365 #ThreatDetection

Here are some recent TTPs for Scattered Spider as well.
www.crowdstrike.com/en-us/blog/c...

#ScatteredSpider are particularly good at #SocialEngineering their way via a third-party to other victims.

For clarity, #ScatteredSpider are considered the initial access group, #DragonForce #ransomware is the malware deployed once #ScatteredSpider are inside your network.

💡 On a side note, this is a great write up on #container #DFIR analysis if you're interested.

🕵🏼‍♂️ This malicious #container uses TENEO heartbeats to effectively earn credits. TENEO's ledger isn't exactly public so tracking the tokens isn't simple, there also doesn't appear to be a way to cash out...yet.

🕵🏼‍♂️ Detect .LNK files making external connections, they are particularly easy to tune.

🕵🏼‍♂️ Detect mshta.exe running suspicious executables (i.e. cmd.exe).

Happy #ThreatHunting

🔗 blog.sekoia.io/detecting-mu...

- Make sure you go #ThreatHunting for compromised systems, prioritise public facing systems.

🕵🏼‍♂️ YARA signature: github.com/Neo23x0/sign...

ℹ️ Public disclosure: www.openwall.com/lists/oss-se...

⚙️ PoC Demo: x.com/Horizon3Atta...

Google's Threat Intelligence Group published details last month of Russian #APTS targeting #Signal

➡️ Maliciously getting victims to scan QR codes
➡️ Maliciously cloning incoming messages with a Linked Device
➡️ Stealing the message database off a device

Vuln Driver Blocklist: learn.microsoft.com/en-us/window...

Win 11 now has a Vulnerable Driver Blocklist feature, however, it's only updated in major updates so you still need to monitor for recently discovered Vulnerable Drivers.

Recent Vuln Driver: www.bleepingcomputer.com/news/securit...

Known Vuln Drivers: www.loldrivers.io

Remember this is just one botnet of #PlugX it's still used in the wild by many other threat actor groups.

For you #DFIR folks, ensure you know how to go #ThreatHunting for DLL-Side Loading to find #PlugX in your network.