See Your Attack Surface Before Adversaries Do.

PowerShell

[UNC-9921] Adversaries are increasingly leveraging obfuscated PowerShell scripts to execute malicious payloads while bypassing standard security monitoring.

Process Injection

[APT-442] Threat actors are injecting malicious code into legitimate system processes to maintain persistence and evade detection by endpoint security tools.

Steganography

[UNC-1042] Recent campaigns have been observed hiding command and control instructions within image files to bypass network traffic analysis.

Cloud Accounts

[APT-889] Adversaries are exploiting misconfigured cloud service accounts to gain unauthorized access to sensitive organizational data environments.

Gather Victim Identity Information: Email Addresses

[APT-32] Actors are embedding tracking links in emails to verify active victim accounts and confirm successful delivery of malicious payloads.

Protocol or Service Impersonation

[UNC-773] Threat actors are masking command and control traffic by mimicking legitimate web service protocols to thwart security analysis.

Domain Account

[UNC-551] Following initial access, actors are performing LDAP queries against domain controllers to map network infrastructure and identify high-value targets.

Spearphishing Attachment

[APT-102] Campaigns are utilizing weaponized documents to trick users into executing malicious macros, leading to full system compromise.

Kerberoasting

[UNC-229] Adversaries are requesting service tickets for domain accounts to perform offline brute-force attacks against service account passwords.

Data Encrypted for Impact

[UNC-440] Ransomware operators are deploying automated encryption routines across enterprise networks to maximize operational disruption.

PowerShell

[UNC-9921] Adversaries are increasingly leveraging obfuscated PowerShell scripts to execute malicious payloads while bypassing standard security monitoring.

Process Injection

[APT-442] Threat actors are injecting malicious code into legitimate system processes to maintain persistence and evade detection by endpoint security tools.

Steganography

[UNC-1042] Recent campaigns have been observed hiding command and control instructions within image files to bypass network traffic analysis.

Cloud Accounts

[APT-889] Adversaries are exploiting misconfigured cloud service accounts to gain unauthorized access to sensitive organizational data environments.

Gather Victim Identity Information: Email Addresses

[APT-32] Actors are embedding tracking links in emails to verify active victim accounts and confirm successful delivery of malicious payloads.

Protocol or Service Impersonation

[UNC-773] Threat actors are masking command and control traffic by mimicking legitimate web service protocols to thwart security analysis.

Domain Account

[UNC-551] Following initial access, actors are performing LDAP queries against domain controllers to map network infrastructure and identify high-value targets.

Spearphishing Attachment

[APT-102] Campaigns are utilizing weaponized documents to trick users into executing malicious macros, leading to full system compromise.

Kerberoasting

[UNC-229] Adversaries are requesting service tickets for domain accounts to perform offline brute-force attacks against service account passwords.

Data Encrypted for Impact

[UNC-440] Ransomware operators are deploying automated encryption routines across enterprise networks to maximize operational disruption.