See Your Attack Surface Before Adversaries Do.

Spearphishing Attachment

[UNC-4921] Adversaries are increasingly using malicious LNK files embedded in ZIP archives to bypass email security gateways and execute initial payloads.

PowerShell

[APT-92] Observed activity shows threat actors utilizing obfuscated PowerShell scripts to download secondary stages directly into memory to avoid disk-based detection.

Valid Accounts: Cloud Accounts

[UNC-8832] Threat actors are leveraging stolen session tokens to bypass multi-factor authentication and gain persistent access to cloud-based productivity suites.

Steal or Forge Kerberos Tickets

[APT-14] Recent intrusions involve the use of Kerberoasting against service accounts to extract password hashes for offline cracking and lateral movement.

Steganography

[UNC-5501] Adversaries are hiding command-and-control instructions within image metadata to evade network traffic analysis and signature-based detection.

Vulnerability Scanning

[APT-33] Automated scanning of public-facing infrastructure for known CVEs in edge devices remains a primary method for identifying initial entry points.

Remote Desktop Protocol

[UNC-2290] Actors are utilizing compromised VPN credentials to establish RDP sessions to internal workstations for data staging and exfiltration.

Data Encrypted for Impact

[UNC-7742] Ransomware operators are deploying updated encryptors that target shadow copies and backup services prior to initiating mass file encryption.

File and Directory Discovery

[APT-55] Post-compromise activity includes the use of native system tools to map network shares and identify sensitive documentation for exfiltration.

Exfiltration Over Cloud Storage

[UNC-1093] Threat actors are abusing legitimate cloud synchronization tools to exfiltrate large volumes of data to actor-controlled storage buckets.

Spearphishing Attachment

[UNC-4921] Adversaries are increasingly using malicious LNK files embedded in ZIP archives to bypass email security gateways and execute initial payloads.

PowerShell

[APT-92] Observed activity shows threat actors utilizing obfuscated PowerShell scripts to download secondary stages directly into memory to avoid disk-based detection.

Valid Accounts: Cloud Accounts

[UNC-8832] Threat actors are leveraging stolen session tokens to bypass multi-factor authentication and gain persistent access to cloud-based productivity suites.

Steal or Forge Kerberos Tickets

[APT-14] Recent intrusions involve the use of Kerberoasting against service accounts to extract password hashes for offline cracking and lateral movement.

Steganography

[UNC-5501] Adversaries are hiding command-and-control instructions within image metadata to evade network traffic analysis and signature-based detection.

Vulnerability Scanning

[APT-33] Automated scanning of public-facing infrastructure for known CVEs in edge devices remains a primary method for identifying initial entry points.

Remote Desktop Protocol

[UNC-2290] Actors are utilizing compromised VPN credentials to establish RDP sessions to internal workstations for data staging and exfiltration.

Data Encrypted for Impact

[UNC-7742] Ransomware operators are deploying updated encryptors that target shadow copies and backup services prior to initiating mass file encryption.

File and Directory Discovery

[APT-55] Post-compromise activity includes the use of native system tools to map network shares and identify sensitive documentation for exfiltration.

Exfiltration Over Cloud Storage

[UNC-1093] Threat actors are abusing legitimate cloud synchronization tools to exfiltrate large volumes of data to actor-controlled storage buckets.