Automating Response to Unauthorized User Privilege Escalations Using PowerShell Commands
Automating response to unauthorized privilege escalation activity such as a user being added to local administrator group using a PowerShell command
Palo Alto Networks
Powershell
Stopping “PowerShell without PowerShell” Attacks
The Cortex XDR Security Research Team recently observed “PowerShell without PowerShell” activity involving PowerShell commands and scripts that do not directly invoke the powershell.exe binary.
Inception Attackers Target Europe with Year-old Office Vulnerability
Inception targets Europe with year old office vulnerability. Read the full report.
Sofacy Attacks Multiple Government Entities
Unit 42 examines recent Sofacy group activities including multiple attacks to government entities.
PowerStager Analysis
Unit 42’s analyzes PowerStager and the unique obfuscation technique it was employing for its PowerShell segments
The Curious Case of Notepad and Chthonic: Exposing a Malicious Infrastructu...
New research from Palo Alto Networks Unit 42: the curious case of Notepad and Chthonic: exposing a malicious infrastructure.
Palo Alto Networks News of the Week – March 11, 2017
Sit back, relax and enjoy the top Palo Alto Networks news of the week.
Pulling Back the Curtains on EncodedCommand PowerShell Attacks
A note to readers: The code samples included within this blog post may trigger alerts from your security software. Please note that this does not indicate an infection or an attack...
PowerWare Ransomware Spoofing Locky Malware Family
Unit 42 has recently discovered a new variant of PowerWare, also known as PoshCoder, imitating the popular Locky ransomware family. PoshCoder has been encrypting files with PowerShell since 2014, and the new va...
The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helmint...
In May 2016, Unit 42 observed targeted attacks primarily focused on financial institutions and technology organizations within Saudi Arabia. Artifacts...
Retefe Banking Trojan Targets Sweden, Switzerland and Japan
Retefe is one of the most targeted banking Trojans currently in the wild. While other families such as Zeus and Citadel are widely adopted by attacker...
Subscribe to the Blog!
Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.