Developing and prioritizing a detection engineering backlog based on MITRE ATT&CK

Detection is a traditional type of cybersecurity control, along with blocking, adjustment, administrative and other controls. Whereas before 2015 teams asked themselves what it was that they were supposed to detect, as MITRE ATT&CK evolved, SOCs were presented with practically unlimited space for...

Microsoft Teams VDI 2.0 Fatal Exception Information

Overview Microsoft has recently started to roll out their New VDI solution for Teams. As soon as the rollout started, some of our customers started experiencing a fatal exception resulting in a blue screen. This fatal exception happens only on 2203 LTSR CU2 and below or 2303 CR and below. This...

Teams 2.1 Start Menu shortcut not working

Teams 2.x Start menu shortcut does not work. It is visible but the icon is missing and clicking it does not launch Teams...

Installing Teams 2.x in an App Layering

Teams will not work properly in an image if it was installed in an App Layer using any version for App Layering prior to 2403.2...

LiteLLM Access Control Error Vulnerability

LiteLLM is an open source application from LiteLLM. All LLM APIs can be called using the OpenAI format. An Access Control Error vulnerability exists in LiteLLM version 1.34.34, which stems from an improper access control issue in the Team Management feature that allows an attacker to...

From Top Dogs to Unified Pack

Embracing a consolidated security ecosystem Authored by Ralph Wascow Cybersecurity is as unpredictable as it is rewarding. Each day often presents a new set of challenges and responsibilities, particularly as organizations accelerate digital transformation efforts. This means you and your cyber...

Malicious code in teams-web-part-application (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3084 Malicious code in teams-web-part-application (npm)

--- -= Per source details. Do not edit below this line.=-...

BokuLoader - A Proof-Of-Concept Cobalt Strike Reflective Loader Which Aims To Recreate, Integrate, And Enhance Cobalt Strike's Evasion Features!

A proof-of-concept User-Defined Reflective Loader UDRL which aims to recreate, integrate, and enhance Cobalt Strike's evasion features! Contributors: Contributor | Twitter | Notable Contributions ---|---|--- Bobby Cooke | @0xBoku | Project original author and maintainer Santiago Pecin | @s4ntiago...

INE Security: Optimizing Teams for AI and Cybersecurity

Cary, United States, 20th June 2024, CyberNewsWire...

The Annual SaaS Security Report: 2025 CISO Plans and Priorities

Seventy percent of enterprises are prioritizing investment in SaaS security by establishing dedicated teams to secure SaaS applications, as part of a growing trend of maturity in this field of cybersecurity, according to a new survey released this month by the Cloud Security Alliance CSA. Despite...

Malvertising Campaign Leads to Execution of Oyster Backdoor

The following analysts contributed to this blog: Thomas Elkins, Daniel Thiede, Josh Lockwood, Tyler McGraw, and Sasha Kovalev. Executive Summary Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and...

Malvertising Campaign Leads to Execution of Oyster Backdoor

The following analysts contributed to this blog: Thomas Elkins, Daniel Thiede, Josh Lockwood, Tyler McGraw, and Sasha Kovalev. Executive Summary Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and...

CVE-2024-37883 Nextcloud Deck can access comments and attachments of deleted cards

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is...

Black Basta Ransomware May Have Exploited MS Windows Zero-Day Flaw

Threat actors linked to the Black Basta ransomware may have exploited a recently disclosed privilege escalation flaw in the Microsoft Windows Error Reporting Service as a zero-day, according to new findings from Symantec. The security flaw in question is CVE-2024-26169 CVSS score: 7.8, an elevati...

PT-2024-6144 · Microsoft · Teams

Name of the Vulnerable Software and Affected Versions: Microsoft Teams versions 24046.2813.2770.1094 Description: A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams for macOS. A specially crafted library can leverage Teams's access...

PT-2024-6145 · Microsoft · Teams

Name of the Vulnerable Software and Affected Versions: Microsoft Teams work or school version 24046.2813.2770.1094 for macOS Description: A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams for macOS. This issue allows a specially crafted library to leverage...

DarkGate switches up its tactics with new payload, email templates

This post was authored by Kalpesh Mantri. Cisco Talos is actively tracking a recent increase in activity from malicious email campaigns containing a suspicious Microsoft Excel attachment that, when opened, infected the victims system with the DarkGate malware. These campaigns, active since the...

Microsoft is named a leader in the Forrester Wave for XDR

“Defenders think in lists, attackers think in graphs.”1 This remains a reality for the many organizations that operate across siloed security tools, fueling the demand on security operations SOC teams, as advanced cyberattacks continue to increase in frequency and speed. That’s where extended...

CWA 2402 - Microsoft Teams VDI plugin is not shown for Non-Admin user

When installing Citrix Workspace app 2402 LTSR for Windows CWA or later version with Administrator privileges, all the three Add-ons single sign-on, App Protection, Microsoft Teams VDI plugin are shown. But if installing CWA 2402 with non-admin user, all the three Add-ons are not shown...