Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Process CommandLine
tracking CVE-2026-73570
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthe 2026-9-30 14:0:0 Author: www.microsoft.com(查看原文) 阅读量:1 收藏 Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments | #ransomware | #cybercrime
Tactic Observed activity Microsoft Defender coverage Execution Storm-2570 delivers tools such as PsExec, Impacket, NetExec, and RDP batch scripts, to carry out post-compromise activity Microsoft Defender Antivirus – Behavior:Win32/PsexecRemote Microsoft Defender for Endpoint – Hands-on-keyboard attack involving multiple devices – Remote access software – Suspicious PowerShell command line – Suspicious PowerShell download or encoded command execution – Ransomware-linked threat actor detected...
StormEncryptor Hits N-able Bug: 50% Unpatched [2026] | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware
A China-linked hacking crew tracked as Storm-1175 has walked away from Medusa, the ransomware-as-a-service strain it rode for years, and started deploying a new, privately built encryptor called StormEncryptor. The switch surfaced on August 2, 2026, the same day a critical authentication-bypass flaw in N-able’s N-central remote monitoring and management console, tracked as CVE-2026-18577, went public.
How a single page can RCE the host running your AI agent
Ongoing research into AI agent framework security identified an exploit chain in AutoGen Studio (AutoGen’s open-source prototyping user interface) that allows untrusted web content rendered by a browsing agent to reach a local Model Context Protocol (MCP) WebSocket and spawn arbitrary processes on the host. The technique, which we call AutoJack, jacks the agent into becoming the attacker’s last-mile delivery vehicle by crossing the localhost trust boundary that many developer tools rely on.
Covert Operations Through QEMU
The Detection & Response Chronicles: Covert Operations Through QEMU Adversaries have always relied on legitimate tools to carry out their attacks. These tools are a 2026-6-4 14:26:5 Author: blog.nviso.eu(查看原文) 阅读量:8 收藏 Adversaries have always relied on legitimate tools to carry out their attacks. These tools are already trusted by security solutions, which allows them to blend in with normal activity, maintain a low footprint, and make detection much harder for defenders.
Identifying Ransomware Final Stage activities with KQL Queries
When ransomware strikes, it doesn’t just encrypt files — it often wraps up with a series of stealthy moves meant to lock you out, cover tracks, and make recovery a nightmare. That’s why it’s so important to spot these final-stage activities before the damage is permanent. The techniques below are commonly seen during the final stage of ransomware attacks, and I recommend setting them up as detection rules in your Defender XDR or Microsoft Sentinel environment.
Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI
Exchange Server and SharePoint Server are business-critical assets and considered crown jewels for many organizations, making them attractive targets for attacks. To help customers protect their environments and respond to these attacks, Exchange Server and SharePoint Server now integrate with the Windows Antimalware Scan Interface (AMSI), a versatile standard that enables applications and services to work seamlessly with any AMSI-compatible antimalware product.
Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions
Microsoft Threat Intelligence discovered a new macOS vulnerability that could allow attackers to bypass Apple’s System Integrity Protection (SIP) in macOS by loading third party kernel extensions. SIP is a security technology that restricts the performance of operations that may compromise system integrity; thus, a SIP bypass affects the overall security of the operating system.
Securing gateways and control points
When AI infrastructure becomes the target: Securing gateways and control points AI is creating a new layer of enterprise infrastructure. Gateways, retrieval platforms, orchest 2026-8-26 16:43:53 Author: www.microsoft.com(查看原文) 阅读量:4 收藏 AI is creating a new layer of enterprise infrastructure. Gateways, retrieval platforms, orchestration services, and containerized runtimes now sit between users, applications, data, and models.
Azure Serial Console Attack and Defense - Part 2
This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines.
Guidance for investigating attacks using CVE-2023-23397
February 15, 2024 update – On January 20, 2024, the US government conducted a disruption operation against infrastructure used by a threat actor we track as Forest Blizzard (STRONTIUM), a Russian state-sponsored threat actor, as detailed here: https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian December 4, 2023 update – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia,...
Guidance for investigating attacks using CVE-2023-23397
December 4, 2023 update – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia, actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers.
Guidance for investigating attacks using CVE-2023-23397
December 4, 2023 update – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM), based in Russia, actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers.
Migrate advanced hunting queries from Microsoft Defender for Endpoint
Read in English Read in English Feedback Edit Twitter LinkedIn Facebook Email Article 04/05/2022 6 minutes to read In this article Note Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender. Applies to: Microsoft 365 Defender Move your advanced hunting workflows from Microsoft Defender for Endpoint to proactively hunt for threats using a broader set of data.
KQL Series – KQL usage with Advanced Hunting (this is huge) – SQLServerCentral
This blog post is about another use of KQL that will definitely help your organisation and make you very popular. First of all check out this video here which can help you learn stuff about KQL: https://www.microsoft.com/en-us/videoplayer/embed/RWRwfJ?postJsllMsg=true I have been talking about KQL and using it with Log Analytics and also Application Insights.
Getting Started with Windows Defender ATP Advanced Hunting
We’ve recently released a capability called Advanced Hunting in Windows Defender ATP that allows you to get unfiltered access to the raw data inside your Windows Defender ATP tenant and proactively hunt for threats using a powerful search and query language. Why should I care about Advanced Hunting? There will be situations where you need to quickly determine if your organization is impacted by a threat that does not yet have pre-established indicators of compromise (IOC).
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Process
Contact Process, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack