Navigation section
malicious activity
-
AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities
Original release date: March 3, 2021 Summary Cybersecurity and Infrastructure Security (CISA) partners have observed active exploitation of vulnerabilities in Microsoft Exchange Server products. Successful exploitation of these vulnerabilities allows an unauthenticated attacker to execute...- News
- Thread
- active directory cve-2021-26855 cybersecurity exchange server forensic analysis incident response indicators of compromise malicious activity microsoft mitigations monitoring network security patches remote code execution security tactics threat intelligence user-agents vulnerabilities webshells
- Replies: 0
- Forum: Security Alerts
-
AA20-336A: Advanced Persistent Threat Actors Targeting U.S. Think Tanks
Original release date: December 1, 2020<br/><h3>Summary</h3><p class="tip-intro" style="font-size: 15px;"><em>This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the <a href="Techniques - Enterprise | MITRE ATT&CK®">ATT&CK for...- News
- Thread
- apt cisa cybersecurity data exfiltration fbi incident response malicious activity mitigation multi-factor authentication network security phishing remote access security awareness security policy tactics techniques think tanks threat actors vulnerabilities
- Replies: 0
- Forum: Security Alerts
-
AA20-304A: Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data
Original release date: October 30, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques. This joint cybersecurity advisory...- News
- Thread
- acunetix api security cisa cyber attacks cyber threats cybersecurity data exfiltration disinformation election security fbi incident response iranian apt malicious activity mitigations reconnaissance sql injection user agents voter registration voting processes vulnerability scanning
- Replies: 0
- Forum: Security Alerts
-
AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity
Original release date: September 1, 2020 Summary This joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,[Link Removed] Canada,[2] New Zealand,[3][4] the United Kingdom,[5] and the United States.[Link Removed] It...- News
- Thread
- access control cybersecurity data exfiltration data protection firewall security incident management incident response indicators of compromise log management malicious activity mitigation techniques monitoring tools network security network segmentation remote access system administration threat analysis user education user training vulnerability assessment
- Replies: 0
- Forum: Security Alerts
-
AA20-198A: Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation
Original release date: July 16, 2020 Summary This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) and Pre-ATT&CK frameworks. See the MITRE ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. Attributing...- News
- Thread
- access control antivirus best practices cybersecurity denial of service email safety firewall geolocation incident response malicious activity mitigations network tunneling packet spoofing removable media security updates situational awareness spoofing threat actor virtual private network vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor
Original release date: July 1, 2020 | Last revised: July 2, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This...- News
- Thread
- anonymity att&ck framework cisa command and control cyber threats cybersecurity data breaches exfiltration fbi identity cloaking incident response malicious activity malicious actors network defense network monitoring privacy risk mitigation threat assessment tor traffic analysis
- Replies: 0
- Forum: Security Alerts
-
AA20-126A: APT Groups Target Healthcare and Essential Services
Original release date: May 5, 2020 Summary This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). CISA and NCSC continue to see indications that...- News
- Thread
- apt groups authentication covid-19 cyber incidents cybersecurity data theft healthcare incident management intellectual property malicious activity mitigation network security pharmaceuticals remote work research organizations sensitive data supply chains threat actors vpn vulnerabilities
- Replies: 0
- Forum: Security Alerts
-
AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor
Original release date: July 1, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This advisory—written by the...- News
- Thread
- anonymity apt cisa command and control cybersecurity data exfiltration data manipulation denial of service exploitation fbi incident response indicators of compromise malicious activity network monitoring network security reconnaissance risk mitigation security tools threat actors tor
- Replies: 0
- Forum: Security Alerts
-
TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
Original release date: October 03, 2018 Systems Affected Network Systems Overview The National Cybersecurity and Communications Integration Center (NCCIC) is aware of ongoing APT actor activity attempting to infiltrate the networks of global managed service providers (MSPs). Since May 2016...- News
- Thread
- apt attack vectors cloud computing credential theft cybersecurity data protection incident reporting incident response malicious activity managed service providers mitigation techniques nccic network security operational controls security controls system administration technical alert threat actors threat intelligence vulnerability management
- Replies: 0
- Forum: Security Alerts
-
TA18-275A: HIDDEN COBRA – FASTCash Campaign
Original release date: October 02, 2018 Systems Affected Retail Payment Systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS), the Department of the Treasury (Treasury), and the Federal Bureau of Investigation...- News
- Thread
- atm banking infrastructure cyber threat cybersecurity dhs fastcash fbi financial fraud hidden cobra incident response iso 8583 malicious activity malware network defense payment systems risk mitigation spyware technical alert treasury vulnerability
- Replies: 0
- Forum: Security Alerts
-
A
Interactive LogOn type in windows AD events
Hello All, Greetings!!! In our environment we monitor windows events 4624 and 4625 on AD for other workstations as all workstations can not integrated in a SIEM. However, in event 4624 and 4625, we are not getting any type 10 or type 2 logon type that could tell us the interactive logon has...- amane
- Thread
- activity credentials detection event 4624 event 4625 events guidance interactive logon malicious activity monitoring policy security siem type 10 type 2 type 3 windows ad workstation
- Replies: 5
- Forum: Windows Server Forums
-
TA18-074A: Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors
Original release date: March 15, 2018 Systems Affected Domain Controllers File Servers Email Servers Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert...- News
- Thread
- critical infrastructure cyber kill chain cybersecurity dhs email security energy sector fbi incident response indicators of compromise industrial control systems intrusion detection malicious activity malware network security remote access russian government spear phishing technical alert threat actors watering hole attack
- Replies: 0
- Forum: Security Alerts
-
TA17-318B: HIDDEN COBRA – North Korean Trojan: Volgmer
Original release date: November 14, 2017 Systems Affected Network systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS...- News
- Thread
- backdoor trojan botnet cybersecurity dhs fbi hidden cobra incident response indicators of compromise ip addresses malicious activity malware malware analysis mitigation network defense network security north korea spear phishing trojan user-agent volgmer
- Replies: 0
- Forum: Security Alerts
-
TA17-293A: Advanced Persistent Threat Activity Targeting Energy and Other Critical...
Original release date: October 20, 2017 Systems Affected Domain Controllers File Servers Email Servers Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert...- News
- Thread
- apt control systems credential harvesting cyber espionage cybersecurity dhs energy sector fbi ics incident response indicators of compromise malicious activity malware network security scada spear phishing staging targets technical alert threat detection watering hole attack
- Replies: 0
- Forum: Security Alerts
-
TA16-336A: Avalanche (crimeware-as-a-service infrastructure)
Original release date: December 01, 2016 Systems Affected Microsoft Windows Overview “Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and malware distribution campaigns and money mule schemes. The United States Department of...- News
- Thread
- anti-virus avalanche botnet crimeware cybersecurity data theft denial of service dhs fast-flux fbi financial fraud malicious activity malware phishing ransomware remediation security updates sensitive data user safety windows
- Replies: 0
- Forum: Security Alerts
-
VIDEO The Myth of the Ethical Hacker
"From the rise of retro fashion trends, art, music, and literature (as inspired by some great 21st century works of literature like "Pride and Prejudice and Zombies" and the complete stereo remastered works of The Beatles), I explore the notion of a Hacking Renaissance taking place today and...- Mike
- Thread
- 1990s anonymous black hat computer security corporate espionage cultural critique cybersecurity digital privacy ethical hacking hackers hacking information security internet lulz security malicious activity nostalgia online community pop culture society white hat
- Replies: 3
- Forum: The Water Cooler
-
Windows 7 Extracting USB Artifacts from Windows 7
Link Removed - Invalid URL USBDeview - View all installed/connected USB devices on your systemView any installed/connected USB device on your system Link Removed The article discusses some of the artifacts that a USB storage device leaves on a system when it has been plugged in, how...- cybercore
- Thread
- computer forensics data exfiltration event timing forensic examination guid historical data malicious activity malware network security ntuser.dat registry sensitive information setupapi.log storage devices usb analysis usb artifacts usb security usbdeview windows 7
- Replies: 0
- Forum: Windows Tutorials
-
D
Windows 7 Detect SQL Injection Attack
What is SQL Injection Attacks With the growing up of B/S model application development, more and more programmer write program with it. Unfortunately, many programmers did not judge the validity of users’ input data during encoding, and then, there will be security risk in...- DevidHuang
- Thread
- access control alarming attack content change cybersecurity data protection database detection firewall ids malicious activity network security sax2 security sql injection threat prevention user input vulnerability web application
- Replies: 0
- Forum: Windows Security