Resource Development threat hunts
2 hunts covering resource development, each with a hypothesis, the queries that test it and what the hunt cannot see.
2 hunts
-
high Part 1 of 2Research by @TheM3gatr0n
Autonomous Exploitation Loop Against Commerce, Mail and Edge Services
An autonomous, LLM-driven attack platform is repeatedly working an internet-facing commerce, mail or edge service, recording each failure and changing approach between sessions, until a web or mail delivery process on the host starts executing shell commands.
7 query1 analytic1 checkpoint1 action2 taskCVE-2024-34102 · CVE-2022-24086 -
mediumResearch by Microsoft
Interaction with BEC Lookalike Infrastructure
An employee has received a BEC email and is interacting with lookalike infrastructure to view a fake invoice or initiate a fraudulent payment.
3 query2 analytic2 checkpoint1 action2 taskinitial access · reconnaissance · resource development