PowerShell – PossibleThreat Articles

Independent Krebs Security

Microsoft Patch Tuesday, December 2022 Edition

December 14, 2022 0 Comments apple zero-day, cve-2022-41076, cve-2022-44698, cve-2022-44710, cve-2022-44713, greg wiseman, immersive labs, kevin breen, Latest Warnings, microsoft patch tuesday december 2022, PowerShell, rapid7, security tools, sophos, Time to Patch, trend micro's zero day initiative, will dormann, Windows

Credit to Author: BrianKrebs| Date: Wed, 14 Dec 2022 17:01:07 +0000

Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. The most pressing patches include a zero-day vulnerability in a Windows feature that tries to flag malicious files from the Web, a critical bug in PowerShell, and a dangerous flaw in Windows 11 systems that was detailed publicly prior to this week’s Patch Tuesday.

MalwareBytes Security

APT28 attack uses old PowerPoint trick to download malware

September 28, 2022 0 Comments APT28, Fancy Bear, news, one drive, powerpoint, PowerShell, syncappvpublishingserver

Categories: News

Tags: APT28

Tags: Fancy Bear

Tags: PowerPoint

Tags: PowerShell

Tags: One Drive

Tags: SyncAppvPublishingServer

The Russian APT known as Fancy Bear was caught using an old mouseover technique that doesn’t need macros

(Read more…)

The post APT28 attack uses old PowerPoint trick to download malware appeared first on Malwarebytes Labs.

MalwareBytes Security

Forced Chrome extensions get removed, keep reappearing

June 29, 2022 0 Comments active serach bar, custome search bar, extensioninstallforcelist, PowerShell, scheduled task, search extensions, Threat analysis, tommy tech, your browser is managed

Credit to Author: Pieter Arntz| Date: Wed, 29 Jun 2022 10:38:18 +0000

Malwarebytes found a family of forced Chrome extensions that can’t be removed because of a policy change that tells users “Your browser is managed”.

The post Forced Chrome extensions get removed, keep reappearing appeared first on Malwarebytes Labs.

MalwareBytes Security

A week in security (June 20 – June 26)

June 27, 2022 0 Comments 311, 7-zip, A week in security, APT28, catfishing, chrome, conti, conti ransomware, cryptocurrency, cryptocurrency scam, cybersecurity emergency, DDoS, DDoS-for-hire, dfscoerce, FBI, internet safety month, LinkedIn, linkedin scam, Magecart, mark of the web, mega, ntlm relay attack, phishing, PowerShell, Ransomware, vacation cybersecurity, vacation privacy, voicemail phishing

Credit to Author: Malwarebytes Labs| Date: Mon, 27 Jun 2022 09:30:06 +0000

The most important and interesting computer security stories from the last week.

The post A week in security (June 20 – June 26) appeared first on Malwarebytes Labs.

MalwareBytes Security

Cybersecurity agencies: You don’t have to delete PowerShell to secure it

June 24, 2022 0 Comments amsi, applocker, credential protection, fileless malware, logging, persistence, PowerShell, security world, ssh, winrm

Credit to Author: Pieter Arntz| Date: Fri, 24 Jun 2022 11:34:04 +0000

International cybersecurity authorities have published a Cybersecurity Information Sheet on making it harder to abuse PowerShell

The post Cybersecurity agencies: You don’t have to delete PowerShell to secure it appeared first on Malwarebytes Labs.

Security Sophos

Confluence exploits used to drop ransomware on vulnerable servers

June 16, 2022 0 Comments atlassian, cerber, confluence, cryptoguard, cve-2022-26134, featured, Intercept X, PowerShell, Ransomware, security operations, sophos managed threat response (mtr), SophosLabs Uncut, threat research, tomcat, webshell

Credit to Author: Andrew Brandt| Date: Thu, 16 Jun 2022 11:00:03 +0000

Automated attacks are now widely exploiting the Atlassian vulnerability

Security Sophos

Telerik UI exploitation leads to cryptominer, Cobalt Strike infections

June 15, 2022 0 Comments cobalt strike, Cryptomining, cve-2017-11357, cve-2017-1137, cve-2019-18935, PowerShell, security operations, SophosLabs Uncut, telerik, threat research, xmrig

Credit to Author: Matt Wixey| Date: Wed, 15 Jun 2022 11:00:05 +0000

Attacker targets bugs in a popular web application graphical interface development tool

MalwareBytes Security

Custom PowerShell RAT targets Germans seeking information about the Ukraine crisis

May 16, 2022 0 Comments germany, PowerShell, rat, threat intelligence, ukraine

Credit to Author: Threat Intelligence Team| Date: Mon, 16 May 2022 10:00:00 +0000

Malwarebytes Threat Intelligence has uncovered an attack using the lure of information about the war in Ukraine to target people in Germany.

The post Custom PowerShell RAT targets Germans seeking information about the Ukraine crisis appeared first on Malwarebytes Labs.

MalwareBytes Security

Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique

April 5, 2022 0 Comments colibri, loader, PowerShell, threat intelligence

Credit to Author: Threat Intelligence Team| Date: Tue, 05 Apr 2022 18:36:35 +0000

We discovered an interesting trick used by Colibri Loader to survive reboots that takes advantage of a legitimate command in PowerShell.

The post Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique appeared first on Malwarebytes Labs.

Security Sophos

Reconstructing PowerShell scripts from multiple Windows event logs

March 29, 2022 0 Comments 4104, Forensics, PowerShell, security operations, threat research

Credit to Author: Vikas Singh| Date: Tue, 29 Mar 2022 18:27:50 +0000

On the trail of malicious PowerShell artifacts too large to be contained in a single log? Help is on the way.

← Previous