Author: Curated

Microsoft Patch Tuesday, May 2025 Security Update Review

Source: Qualys Security Blog

Author: Diksha Ojha

URL: https://blog.qualys.com/vulnerabilities-threat-research/2025/05/13/microsoft-patch-tuesday-may-2025-security-update-review

Microsoft’s May 2025 Patch Tuesday Summary — Key Highlights & Recommendations:

Microsoft rolled out security updates addressing a total of 76 vulnerabilities for this month’s Patch Tuesday, including:

  • 5 Critical vulnerabilities
  • 66 Important vulnerabilities
  • 6 actively exploited zero-day vulnerabilities

Key highlights from this month’s update include:

  1. Zero-day Vulnerabilities Patched:

Microsoft Defender for Identity Spoofing Vulnerability (CVE-2025-26685)

  • Severity: Important (CVSS score: 6.5)
  • Exploitation: An unauthenticated attacker with LAN access could spoof network identities.

Microsoft DWM Core Library Elevation of Privilege (CVE-2025-30400) – Actively exploited zero-day added to CISA KEV (Known Exploited Vulnerabilities) catalog, patch required by June 3, 2025

  • Impact: Authenticated attackers may gain SYSTEM privileges via a use-after-free vulnerability.

Windows Common Log File System (CLFS) Driver Elevation of Privilege (CVE-2025-32701 & CVE-2025-32706) – Both in the KEV catalog, must patch by June 3, 2025

  • Impact: Use-after-free and improper input validation vulnerabilities can grant SYSTEM privileges to attackers with local access.

Microsoft Scripting Engine Memory Corruption Vulnerability (CVE-2025-30397) – Added to KEV catalog

  • Impact: An attacker can achieve remote code execution by convincing a user to interact with a malicious link.

Windows Ancillary Function Driver for WinSock Elevation of Privilege (CVE-2025-32709) – Added to KEV catalog

  • Impact: Authenticated attackers with local access can escalate privileges via use-after-free vulnerability.
  1. Critical Remote Code Execution (RCE) Vulnerabilities:

Remote Desktop Client RCE vulnerabilities (CVE-2025-29966, CVE-2025-29967)

  • Heap-based buffer overflow vulnerabilities enabling unauthenticated remote code execution attacks.

Microsoft Office RCE vulnerabilities (CVE-2025-30377, CVE-2025-30386)

  • Use-after-free vulnerabilities enable remote code execution with no authentication.

Virtual Machine Bus (VMBus) RCE (CVE-2025-29833)

  • Enabled by race-condition (TOCTOU), allows authenticated attackers executing remote code in virtualized environments.
  1. Additional Notable Vulnerabilities:
  • Kernel Streaming Service Driver Elevation of Privilege (CVE-2025-24063)
  • Windows Graphics Component Remote Code Execution (CVE-2025-30388)
  • Universal Print Management Service Elevation of Privilege (CVE-2025-29841)
  • Windows Common Log File System Disc Stability (CVE-2025-30385) causing system crashes
  • Web Threat Defense Denial of Service (CVE-2025-29971)
  • Microsoft SharePoint Vulnerabilities (CVE-2025-29976 & CVE-2025-30382)

Impacted Products and Components Include:

  • Windows Core Components (Kernel, Drivers, DWM, NTFS, CLFS, SMB, Hyper-V, etc.)
  • Microsoft Defender Solutions (Endpoint, Identity)
  • Microsoft Office Suite (Office core apps, Excel, SharePoint, Outlook, PowerPoint)
  • Virtualization and Enterprise Products (Azure, Remote Desktop Gateway, Hyper-V, Azure DevOps)
  • Developer Tools (.NET, Visual Studio, Tools for Visual Studio)
  • Web-based Solutions and Protocols (LDAP, UrlMon, Web Threat Defense, Azure Automation)
  • Various Windows subsystems (Media, Installer, Routing, Virtual Machine Bus, Win32K Graphics, etc.)

Vendor-Recommended Mitigation & Policy Audit (Qualys):

Qualys has updated its Policy Audit Control IDs (CID: 10968, 2181) specifically for mitigating CVE-2025-26685 (Microsoft Defender for Identity):

  • CID 10968: Network access control setting restricting remote calls to SAM
  • CID 2181: Configuration identifying Groups and User Accounts with the “Access this computer from the network” right

Recommended Qualys Query Language (QQL) to perform posture assessment:

control.id: [10968, 2181]

Immediate Recommendations & Best Practices:

  • Expedite patching all actively exploited zero-day vulnerabilities by June 3, 2025 per CISA recommendations.
  • Prioritize Critical severity RCE vulnerabilities and widely deployed software (Office, Remote Desktop Client, Virtual Machine Bus).
  • Deploy May 2025 security updates across all applicable Microsoft systems ASAP to protect against potential exploitation.
  • Apply vendor-suggested mitigations where immediate patching is not feasible.
  • Regularly revisit and verify compensatory controls with security audits such as Qualys Policy Audit.

Next steps and follow-up:

  • Participate in vendor webinars and advisory sessions provided for Patch Tuesday by vendors such as Qualys to ensure comprehensive understanding, prioritization, and remediation guidance.
  • Continuously monitor for vulnerability exploitation signs and unusual activity while deploying patches.

Next Patch Tuesday date is set for June 10, 2025. Stay proactive and secure.

73% of CISOs admit security incidents due to unknown or unmanaged assets

Source: 73% of CISOs admit security incidents due to unknown or unmanaged assets | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/3980431/more-assets-more-attack-surface-more-risk.html

Key Takeaways:

  1. Lack of Asset Visibility and Accurate Management
    Almost three-quarters (73%) of cybersecurity leaders experienced incidents directly linked to unidentified or improperly managed IT assets. Without full visibility into their digital environments, organizations struggle to fully grasp the extent and nature of their potential vulnerabilities, significantly weakening their cybersecurity.

  2. Recognition of Impact on Business Risk
    Approximately 9 out of 10 executives recognize the critical importance of effectively managing the digital attack surface as it directly affects business risk. Security issues stemming from mismanaged or unknown IT assets can have serious consequences, including interruptions in business continuity (42%), harm to customer trust and brand reputation (39%), diminished competitiveness (39%), weakened supplier relationships (39%), and negative impacts on employee productivity and financial performance (38% each).

  3. Inadequate adoption of Proactive Risk Management
    Despite clear recognition of the threat and the potential negative impacts on business operations, only 43% of companies actively use specialized tools for proactive attack surface management. A large majority (58%) stated they lack continuous monitoring processes—even though such proactive security management tools and monitoring are essential for promptly mitigating and containing cybersecurity risks.

  4. Urgent Call to Action
    The survey highlights an increasing urgency for improving cybersecurity posture. Many enterprises remain behind the curve, reluctant or slow in adopting robust security strategies, tools, and ongoing monitoring processes needed to contain their rapidly expanding cyber risks. Cyber risk management must be prioritized at the highest levels to safeguard enterprises effectively.

In conclusion, the Trend Micro survey points to a common cybersecurity challenge: while businesses are aware of the problem and its serious consequences, actual implementation to proactively manage and reduce the attack surface remains limited and inadequate. Chief security officers and business leaders must urgently prioritize comprehensive visibility, proper asset inventory management, continuous risk monitoring, and proactive management to minimize cybersecurity incidents and shield their organization from severe business disruptions.

Utilizing ASNs for Hunting & Response

Source: Huntress Blog

Author: unknown

URL: https://www.huntress.com/blog/utilizing-asns-for-hunting-and-response

ONE SENTENCE SUMMARY:

ASN enrichment of IP addresses significantly enhances threat detection and incident response effectiveness beyond basic geolocation data alone.

MAIN POINTS:

  1. IP addresses are important but limited without enrichment for investigative analysis.
  2. Autonomous Systems Numbers (ASNs) identify networks with unified routing policies.
  3. ASN enrichment provides context beyond basic geographic IP address data.
  4. Knowing an IP’s ASN can distinguish residential ISPs from suspicious hosting providers.
  5. ASN data helped identify compromised accounts during remote desktop intrusions.
  6. ASN telemetry highlighted malicious authentications in a RADIUS password spray incident.
  7. Geolocation alone failed to detect compromise, underscoring ASN enrichment’s value.
  8. VPN compromise cases frequently rely on ASN data to confirm malicious behavior.
  9. Authentication anomalies identified via ASN enrichment can guide security responses.
  10. ASN enrichment supports accurate narrative building and risk-based security recommendations.

TAKEAWAYS:

  1. Always enrich IP addresses with ASN data during investigations.
  2. Do not rely solely on IP geolocation; ASN adds critical context.
  3. Analyze authentication patterns alongside ASN data to detect anomalies.
  4. Recognize that certain ASNs frequently correlate with malicious activities.
  5. Integrate ASN telemetry systematically into threat hunting workflows.

How to capture forensic evidence for Microsoft 365

Source: CISA warns of cyberattacks targeting the US oil and gas infrastructure | CSO Online Author: unknown URL: https://www.csoonline.com/article/3979073/how-to-capture-forensic-evidence-for-microsoft-365.html

ONE SENTENCE SUMMARY:

Enterprise endpoint protection is insufficient without robust cloud security measures, including forensic logging, OAuth protection, and resource allocation.

MAIN POINTS:

  1. Endpoint protections alone no longer fully secure enterprise environments.
  2. Attackers now exploit cloud services and OAuth workflows to gain unauthorized access.
  3. Phishing attacks via applications like Signal and WhatsApp target cloud authentication.
  4. OAuth tokens provide attackers extensive access to Microsoft 365, AWS, or Google Workspace.
  5. Cloud resources often lack sufficient monitoring, logging, and forensic capabilities.
  6. Forensic logging in Microsoft 365 requires specific E5 licenses and configurations.
  7. Microsoft Purview Insider Risk Management enables capturing forensic evidence from cloud resources.
  8. Configuring forensic evidence capturing requires specific roles and administrative steps.
  9. Forensic evidence policy settings should include activity types, bandwidth, and offline capturing limits.
  10. Cloud forensic investigations may involve vendor dependencies and additional storage budget requirements.

TAKEAWAYS:

  1. Strengthen cloud security as attackers shift away from traditional endpoint attacks.
  2. Prioritize OAuth security to protect sensitive cloud-based resources.
  3. Ensure appropriate Microsoft licensing and roles are in place for forensic logging.
  4. Clearly define forensic evidence policies, including bandwidth and storage considerations.
  5. Plan for cloud forensic investigations, accounting for vendor cooperation and potential delays.

Proactive threat hunting with Talos IR

Source: Cisco Talos Blog Author: Mike Trewartha URL: https://blog.talosintelligence.com/proactive-threat-hunting-with-talos-ir/

ONE SENTENCE SUMMARY:

Cisco Talos IR proactively enhances cybersecurity through structured threat hunting using baseline analysis, hypothesis-driven investigations, and machine learning.

MAIN POINTS:

  1. Cisco Talos IR emphasizes proactive threat hunting to prevent cybersecurity incidents.
  2. The PEAK Framework (Prepare, Execute, Act with Knowledge) guides precise threat hunting methodologies.
  3. Baseline hunts document normal system behaviors to detect anomalous activities signaling threats.
  4. Hypothesis-driven hunts test specific assumptions based on emerging threat intelligence.
  5. Model-assisted threat hunts (M-ATH) utilize machine learning to uncover hidden threats.
  6. Talos Threat Intelligence enriches threat hunting, refining hypotheses and enhancing detection accuracy.
  7. Talos IR Retainer customers receive ongoing proactive threat hunting engagements.
  8. Early detection through proactive hunts reduces the risk of threats escalating.
  9. Continuous improvement of hunting models strengthens organizational security posture over time.
  10. Real-time collaboration with Incident Response ensures rapid containment and mitigation.

TAKEAWAYS:

  1. Proactive threat hunting complements traditional cybersecurity defenses.
  2. Establishing baselines is crucial to spotting subtle malicious activities.
  3. Regular hypothesis testing helps anticipate attacker behaviors and tactics.
  4. Leveraging machine learning significantly boosts threat detection capabilities.
  5. Integration of threat intelligence data ensures hunts remain relevant and effective.

sectemplates/incident-response/v1 at main · securitytemplates/sectemplates

Source: GitHub Author: unknown URL: https://github.com/securitytemplates/sectemplates/tree/main/incident-response/v1

ONE SENTENCE SUMMARY:

The Incident Response Program Pack 1.5 provides comprehensive resources, templates, and guidelines to build an effective security incident response program.

MAIN POINTS:

  1. Defines essential incident response terminology, roles, stakeholders, and severity rankings clearly.
  2. Offers a detailed checklist for researching, piloting, testing, and launching the response program.
  3. Provides a simplified incident response workflow aligning with the provided runbook.
  4. Includes a structured incident response runbook to ensure consistent handling of incidents.
  5. Presents a working document template designed for comprehensive incident detail capturing.
  6. Recommends a structured, blameless postmortem to evaluate incidents and improve future responses.
  7. Supplies filled-out examples of working documents and postmortem templates for practical reference.
  8. Highlights key metrics useful for effectively measuring the incident response program’s performance.
  9. Clarifies advantages of using Sectemplates’ battle-tested materials over general AI-generated content.
  10. Suggests NIST 800-61 as a resource for organizations needing a more extensive response framework.

TAKEAWAYS:

  1. Clearly defining roles and severity levels ensures effective communication during incidents.
  2. Using checklists and structured workflows promotes consistency and reliability.
  3. Conducting blameless postmortems encourages honest reflection and continuous improvement.
  4. Utilizing real-world tested templates reduces confusion and enhances operational effectiveness.
  5. Measuring program effectiveness through defined metrics supports continuous improvement efforts.

Kali Linux warns of update failures after losing repo signing key

Source: BleepingComputer Author: Sergiu Gatlan URL: https://www.bleepingcomputer.com/news/linux/kali-linux-warns-of-update-failures-after-losing-repo-signing-key/

ONE SENTENCE SUMMARY:

Offensive Security advises Kali Linux users to manually install a new repository signing key after losing the previous key.

MAIN POINTS:

  1. Offensive Security lost the Kali Linux repository signing key, requiring a replacement key.
  2. Users with the old key experience update failures due to key verification errors.
  3. The repository was temporarily frozen on February 18th to minimize user impact.
  4. OffSec issued a new signing key (ED65462EC8D5E4C5) signed by Kali developers.
  5. Users must manually download and install the new key to resolve the issue.
  6. The recommended command to fetch the new key is provided clearly by OffSec.
  7. Checksums and instructions for verifying the new keyring are available from OffSec.
  8. Users uncomfortable updating keys manually can reinstall Kali using updated images.
  9. This incident mirrors a similar 2018 event when Kali’s GPG key expired.
  10. Regular updating of Kali Linux keyrings is essential to prevent update mismatches.

TAKEAWAYS:

  1. Regularly update Kali Linux systems to avoid key mismatches and repository issues.
  2. Follow official instructions carefully when manually updating repository signing keys.
  3. Verify new repository keys using provided checksums to ensure authenticity.
  4. Consider reinstalling Kali Linux from updated images if unsure about manual key updates.
  5. Maintain awareness of Kali Linux communications to promptly handle security-related updates.

What’s worth automating in cyber hygiene, and what’s not

Source: Help Net Security Author: Mirko Zorz URL: https://www.helpnetsecurity.com/2025/04/29/automating-cyber-hygiene/

ONE SENTENCE SUMMARY:

Automation in cyber hygiene enhances visibility, streamlines patching and credential management, yet requires human oversight to manage exceptions effectively.

MAIN POINTS:

  1. Automate asset discovery first to ensure comprehensive visibility of systems and accounts.
  2. Exposure management tools provide critical external asset discovery without internal assumptions.
  3. Effective exposure management identifies shadow IT, dangling DNS, risky cloud usage, and domain squatting.
  4. Automating patches requires fallback mechanisms, clear alerts, and alignment with business schedules.
  5. Prioritize patches based on vulnerability exploitability, not simply availability.
  6. Automate credential rotation for service accounts, privileged credentials, and API keys.
  7. Credential vaulting tools prevent hardcoded passwords, unauthorized sharing, and provide detailed audit logs.
  8. Automate onboarding and offboarding of employees to ensure timely account provisioning and revocation.
  9. Avoid automating exception handling; humans should approve and renew exceptions regularly.
  10. Automate alerts and reporting with prioritization based on severity, exploitability, and business impact.

TAKEAWAYS:

  1. Always start automation efforts by establishing clear visibility across all digital assets.
  2. Automation should complement, not replace, human judgment—especially regarding exceptions and access logic.
  3. Credential automation and vaulting significantly reduce risk from compromised privileged accounts.
  4. Align automated processes with security frameworks like NIST and ISO to enhance audit readiness and compliance.
  5. Continuously measure automated processes and regularly reassess their effectiveness and risk impact.

Exposure Management Works When the CIO and CSO Are in Sync

Source: Tenable Blog Author: Patricia Grant URL: https://www.tenable.com/blog/exposure-management-works-when-the-cio-and-cso-are-in-sync

ONE SENTENCE SUMMARY: Effective exposure management requires strong CIO-CSO collaboration, unified visibility, proactive endpoint security, strategic prioritization, and clear risk communication.

MAIN POINTS:

  1. CIO and CSO alignment is crucial for successful exposure management.
  2. Shared responsibility between IT and security teams ensures robust enterprise protection.
  3. Constant collaboration is necessary due to rapid shifts in threat landscapes.
  4. Exposure management provides unified visibility across cloud, on-prem, and hybrid assets.
  5. Endpoints require proactive security measures, such as rapid zero-day patching.
  6. Exposure management helps identify unknown risks like forgotten systems and open ports.
  7. Prioritizing vulnerabilities based on impact, not volume, leads to strategic advantage.
  8. Effective cybersecurity requires modernized change management and clear communication.
  9. Cyber risk must be translated into business language for effective board-level discussions.
  10. Visibility through exposure management empowers customers to address critical threats effectively.

TAKEAWAYS:

  1. Foster a close, trusting relationship between CIO and CSO for effective exposure management.
  2. Utilize exposure management tools to prioritize impactful vulnerabilities over sheer quantity.
  3. Implement proactive endpoint security practices, especially rapid response to zero-day threats.
  4. Modernize change management and communication strategies to engage employees effectively.
  5. Translate technical cybersecurity risks into strategic business language for board-level clarity.

SWE-agent/SWE-agent: SWE-agent takes a GitHub issue and tries to automatically fix it, using GPT-4, or your LM of choice.

Source: GitHub Author: unknown URL: https://github.com/SWE-agent/SWE-agent

ONE SENTENCE SUMMARY:

SWE-agent is an autonomous tool-using framework developed by Princeton and Stanford researchers for automated software engineering and cybersecurity tasks.

MAIN POINTS:

  1. SWE-agent allows language models like GPT-4o or Claude Sonnet 3.7 autonomous tool use.
  2. Utilizes agent-computer interfaces (ACIs) for interacting with isolated computer environments.
  3. Developed by researchers from Princeton University and Stanford University.
  4. Offers EnIGMA, a mode specialized in offensive cybersecurity capture-the-flag challenges.
  5. EnIGMA achieves state-of-the-art results in cybersecurity benchmarks.
  6. Includes tools like debugger, server connection, and summarizer for long outputs.
  7. Recommended to use SWE-agent version 0.7 during EnIGMA updates for 1.0.
  8. Community participation encouraged via Discord, with open contributions through GitHub.
  9. Research detailed in academic papers presented at NeurIPS 2024.
  10. MIT licensed project, open for academic citation and use.

TAKEAWAYS:

  1. SWE-agent enhances automated software engineering with autonomous tool use.
  2. Specialized EnIGMA mode excels in cybersecurity competitions.
  3. Important functionalities like debugging and summarizing improve usability.
  4. Active community involvement and contribution are highly encouraged.
  5. Proper citation of SWE-agent and EnIGMA is requested for academic use.

Cybersecurity metrics that matter (and how to measure them)

Source: The Red Canary Blog: Information Security Insights Author: Brian Donohue URL: https://redcanary.com/blog/threat-detection/cybersecurity-metrics/

ONE SENTENCE SUMMARY:

Security operations centers should prioritize accuracy, volume, and timeliness metrics, carefully defining and consistently measuring them to avoid misleading interpretations.

MAIN POINTS:

  1. Security metrics vary widely; clearly defined metrics ensure consistency and usefulness.
  2. SOC metrics typically focus on accuracy, volume, and timeliness.
  3. Mean-based metrics are problematic due to susceptibility to extreme outliers.
  4. Median metrics offer a more accurate representation of typical SOC performance.
  5. Definitions of detection, response, and mitigation significantly impact metric results.
  6. Clarifying when measurement begins and ends is crucial to meaningful SOC metrics.
  7. Time-to-detect can vary based on whether threats are identified or confirmed threats published.
  8. Response metrics must define precisely when a response action officially occurs.
  9. Publicly reported SOC metrics are hard to interpret without underlying context and definitions.
  10. Dwell time differs from breakout time; the latter may be a more critical security metric.

TAKEAWAYS:

  1. Clearly define and standardize measurement terms for SOC metrics.
  2. Favor median over mean to avoid misleading results from outliers.
  3. Clarify exactly when measurement “clocks” start and end for consistent metric tracking.
  4. Consider both dwell time and breakout time when evaluating threat response effectiveness.
  5. Always question and contextualize publicly reported SOC metrics to avoid misinterpretation.

MITRE Launches New D3FEND CAD Tool to Create Precise Cybersecurity Scenarios

Source: Cyber Security News Author: Guru Baran URL: https://cybersecuritynews.com/mitre-launches-new-d3fend-cad-tool/

ONE SENTENCE SUMMARY:

MITRE launched the D3FEND CAD tool, offering structured cybersecurity modeling through semantic knowledge graphs to enhance threat analysis and defense.

MAIN POINTS:

  1. MITRE released D3FEND CAD tool as part of comprehensive D3FEND 1.0 ontology release.
  2. CAD tool uses structured knowledge graphs rather than traditional unstructured cybersecurity diagrams.
  3. D3FEND ontology provides semantically rigorous cybersecurity knowledge representation.
  4. Users create cybersecurity scenarios using intuitive drag-and-drop browser interface.
  5. Attack nodes link directly to MITRE ATT&CK techniques.
  6. Tool includes Countermeasure and Digital Artifact nodes based on D3FEND ontology.
  7. “Explode” feature reveals potential attacks, defenses, and artifacts within nodes.
  8. Supports threat intelligence, modeling, detection engineering, incident investigation, and risk assessment.
  9. Export formats include JSON, TTL, PNG, and STIX 2.1 JSON import capability.
  10. Developed collaboratively by MITRE, NSA, and U.S. defense departments.

TAKEAWAYS:

  1. Structured knowledge modeling improves cybersecurity threat visualization and analysis.
  2. D3FEND CAD enables teams to collaboratively create and share precise cybersecurity scenarios.
  3. Standardized vocabulary and ontology facilitate clear communication across cybersecurity roles.
  4. Integration with MITRE ATT&CK and STIX enhances threat intelligence capabilities.
  5. Adopting structured cybersecurity modeling represents a significant advancement in defense strategy development.

A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why

Source: Security Blogs | Splunk Author: unknown URL: https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html

ONE SENTENCE SUMMARY:

Configuring Windows Advanced Audit Policies effectively balances log volume and relevance, leveraging data-driven strategies and MITRE ATT&CK alignment for optimal threat detection.

MAIN POINTS:

  1. Windows event logs are essential but default logging lacks depth for detecting sophisticated threats.
  2. Windows Advanced Audit Policies provide granular control over security event logging.
  3. Advanced Audit Policies split broad categories into detailed subcategories for precise monitoring.
  4. Effective configuration involves balancing event volume, relevance, and system overhead.
  5. The Splunk Threat Research Team compiled Event ID mappings to simplify auditing configurations.
  6. Excessive logging can overwhelm SIEM solutions, increase costs, and burden analysts.
  7. STRT adopted a data-driven approach, analyzing official Microsoft and third-party guidelines.
  8. Event volume data varies by installed roles, features, and configured System Access Control Lists (SACLs).
  9. Certain subcategories require additional setup, registry edits, or reboots to function properly.
  10. Mapping Windows Event IDs to MITRE ATT&CK techniques helps prioritize critical security events.

TAKEAWAYS:

  1. Prioritize auditing configurations by aligning them to MITRE ATT&CK techniques and threat actor TTPs.
  2. Use STRT’s Event ID mapping resources to streamline and optimize your auditing strategy.
  3. Consider additional configuration requirements for certain audit subcategories to ensure proper logging.
  4. Evaluate event volume and relevance carefully to avoid overwhelming security monitoring systems.
  5. Leverage industry guidelines and real-world incident data to inform decisions on audit policy settings.

Phishers Exploit Google Sites and DKIM Replay to Send Signed Emails, Steal Credentials

Source: The Hacker News Author: [email protected] (The Hacker News) URL: https://thehackernews.com/2025/04/phishers-exploit-google-sites-and-dkim.html

ONE SENTENCE SUMMARY:

Attackers executed a sophisticated phishing attack utilizing Google’s infrastructure and DKIM replay techniques, successfully bypassing security checks to harvest user credentials.

MAIN POINTS:

  1. Attackers leveraged Google’s legitimate email infrastructure for phishing, bypassing typical security alerts.
  2. Phishing emails appeared authentic, passing DKIM, SPF, and DMARC authentication checks.
  3. Victims received fake subpoenas directing them to malicious sites hosted on Google Sites.
  4. Fraudulent websites mimicked Google Support, tricking users into inputting credentials.
  5. Attackers exploited legacy Google Sites’ support of arbitrary scripts to host phishing content.
  6. Emails appeared to originate from “accounts.google.com,” despite originating elsewhere.
  7. DKIM replay attack used Google’s OAuth application process to generate genuine-looking security alerts.
  8. Gmail displayed messages as addressed to “me,” adding authenticity and reducing suspicion.
  9. Google has implemented fixes to prevent this abuse pathway and advised adopting two-factor authentication.
  10. Phishing attacks increasingly exploit SVG attachments to embed malicious HTML and JavaScript.

TAKEAWAYS:

  1. Legitimate infrastructures like Google can be exploited for sophisticated phishing attacks.
  2. DKIM signatures alone cannot guarantee email authenticity; vigilance remains essential.
  3. Legacy services supporting arbitrary scripts pose significant security risks.
  4. Enabling two-factor authentication and passkeys provides critical protection against phishing threats.
  5. Always scrutinize unexpected security alerts, even if they appear authentic and trustworthy.

Widespread Microsoft Entra lockouts tied to new security feature rollout

Source: BleepingComputer Author: Lawrence Abrams URL: https://www.bleepingcomputer.com/news/microsoft/widespread-microsoft-entra-lockouts-tied-to-new-security-feature-rollout/

ONE SENTENCE SUMMARY: A widespread false-positive issue with Microsoft’s new Entra ID “MACE Credential Revocation” app mistakenly locked numerous user accounts.

MAIN POINTS:

  1. Microsoft Entra ID’s new MACE app rollout triggered widespread false account lockouts.
  2. Alerts began last night, locking accounts that had unique passwords and MFA protections.
  3. Admins reported thousands of lockout notifications across multiple organizations.
  4. Reddit threads confirm multiple businesses experienced significant user account impacts.
  5. Affected accounts showed no suspicious activity or matching data breaches.
  6. Microsoft privately attributed the issue to errors during MACE app deployment.
  7. The MACE Credential Revocation app detects leaked credentials to protect user accounts.
  8. Lockouts were mistakenly flagged as leaked credentials from dark web breaches.
  9. Microsoft has not yet publicly acknowledged or explained the incident officially.
  10. Administrators should verify alerts but recognize mass lockouts likely due to rollout issue.

TAKEAWAYS:

  1. Carefully monitor automated security rollouts for potential false positives.
  2. Confirm alerts with independent breach notification tools like Have I Been Pwned.
  3. Maintain clear communication channels with vendors to quickly resolve issues.
  4. Consider temporarily disabling automated lockout actions during major updates.
  5. Ensure rapid internal communication to minimize user disruption during incidents.

SPF Record Cleanup Techniques

Source: dmarcian Author: John Bowers URL: https://dmarcian.com/spf-record-cleanup-techniques/

ONE SENTENCE SUMMARY:

dmarcian provides guidance on avoiding SPF over-authentication by safely removing unnecessary or incorrectly placed SPF include statements from organizational domains.

MAIN POINTS:

  1. Over-authentication occurs when unnecessary email sources remain in SPF records.
  2. SPF statements should be regularly reviewed to remove unused email sending sources.
  3. Subdomain usage is a best practice for proper SPF alignment and reducing lookup counts.
  4. Active Campaign requires subdomains; remove “include:emsd1.com” from organizational SPF.
  5. Adobe Marketo needs a subdomain and trusted IP; remove “include:mktomail.com”.
  6. AmazonSES requires subdomains; remove “include:amazonses.com” from organizational SPF.
  7. Bird (SparkPost) mandates subdomains; remove “_spf.sparkpostmail.com” or “_spf.eu.sparkpostmail.com”.
  8. Cvent cannot achieve SPF alignment; rely on DKIM instead and remove “include:cvent-planner.com”.
  9. Salesforce Marketing Cloud needs Sender Authentication Package; remove “include:cust-spf.exacttarget.com”.
  10. SendGrid usually requires subdomains; remove “include:sendgrid.net” from organizational SPF.

TAKEAWAYS:

  1. Regularly audit SPF records to maintain accuracy and avoid over-authentication.
  2. Use subdomains consistently for SPF alignment to improve email deliverability.
  3. Remove outdated or unnecessary SPF include statements from organizational domains.
  4. Confirm no aligned email volume before removing SPF includes using SPF Surveyor.
  5. Rely on DKIM when SPF alignment is not achievable (e.g., Cvent).

CISOs rethink hiring to emphasize skills over degrees and experience

Source: CISOs rethink hiring to emphasize skills over degrees and experience | CSO Online Author: unknown URL: https://www.csoonline.com/article/3963314/cisos-rethink-hiring-to-emphasize-skills-over-degrees-and-experience.html

ONE SENTENCE SUMMARY: Security leaders increasingly adopt skills-based hiring over degrees, emphasizing competencies, problem-solving, and practical assessments to improve cybersecurity recruitment.

MAIN POINTS:

  1. CISOs are shifting from degree-based hiring to skills-based approaches due to talent shortages.
  2. ISC2’s CISO Jon France removed degree and some certification requirements for cybersecurity roles.
  3. Skills-based hiring evaluates problem-solving, curiosity, and communication over academic credentials.
  4. Implementing skills-based hiring effectively requires significant changes beyond job postings.
  5. Burning Glass Institute’s report indicates limited success so far in skills-based hiring adoption.
  6. Only 37% of organizations studied successfully implemented genuine skills-based hiring methods.
  7. France collaborates with HR to craft job descriptions focused on tasks and required practical skills.
  8. Certifications can still be required post-hiring to confirm willingness and aptitude for continued learning.
  9. CyberSN and Immersive effectively use skills assessments and practical scenarios in hiring processes.
  10. Skills-based hiring has produced diverse candidate pools, improving cybersecurity team performance.

TAKEAWAYS:

  1. Prioritize demonstrable skills, critical thinking, and curiosity over traditional educational credentials.
  2. Collaborate closely with HR to rewrite job descriptions clearly outlining practical skills needed.
  3. Implement thorough candidate assessments using realistic scenarios and problem-solving exercises.
  4. Recognize certifications as useful skill indicators, potentially required after hiring.
  5. Expect significant effort and organizational change to successfully adopt a skills-based hiring approach.

Microsoft blocks ActiveX by default in Microsoft 365, Office 2024

Source: BleepingComputer Author: Sergiu Gatlan URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-blocks-activex-by-default-in-microsoft-365-office-2024/

ONE SENTENCE SUMMARY: Microsoft is disabling ActiveX controls in Office 2024 applications to enhance security against malware and unauthorized code execution risks.

MAIN POINTS:

  1. Microsoft will disable ActiveX controls in Office 2024 apps later this month.
  2. ActiveX, introduced in 1996, enabled interactive embedded objects in Office documents.
  3. Word, Excel, PowerPoint, and Visio will block ActiveX entirely without notification.
  4. A “BLOCKED CONTENT” notification will appear upon opening documents with ActiveX controls.
  5. Microsoft advises users against opening unexpected attachments or changing ActiveX settings unnecessarily.
  6. Existing ActiveX objects will remain visible but non-interactive, appearing as static images.
  7. Users can manually enable ActiveX via Trust Center settings, affecting all Office apps simultaneously.
  8. ActiveX controls have historically been exploited for zero-day vulnerabilities and malware infections.
  9. Cybercriminals have previously used ActiveX in Word documents to deploy TrickBot malware and Cobalt Strike.
  10. Disabling ActiveX aligns with Microsoft’s broader strategy to disable legacy Office features prone to exploitation.

TAKEAWAYS:

  1. Keep ActiveX controls disabled for optimal security unless absolutely necessary.
  2. Be cautious and avoid enabling ActiveX prompted by unknown pop-ups or suspicious attachments.
  3. Consider the security benefits of Microsoft’s ongoing removal of legacy Office vulnerabilities.
  4. Understand that enabling ActiveX via Trust Center settings impacts all Office applications.
  5. Recognize Microsoft’s proactive steps in mitigating malware threats by disabling risky legacy features.

PentestPlaybook/ad-lab-scripts: AD Lab Setup Scripts

Source: GitHub Author: unknown URL: https://github.com/PentestPlaybook/ad-lab-scripts

ONE SENTENCE SUMMARY:

This repository offers automation scripts to quickly build an intentionally vulnerable Active Directory lab environment for penetration testing practice.

MAIN POINTS:

  1. Repository contains scripts for quickly setting up an Active Directory testing environment.
  2. Each script corresponds to a specific virtual machine like Domain Controller or workstation.
  3. Users can selectively deploy machines individually or create complex network scenarios.
  4. Scripts perform roles installation, user creation, and set intentional vulnerabilities.
  5. Environment supports practicing lateral movement and privilege escalation attacks.
  6. Requires placing Windows ISO files in the repository directory before running scripts.
  7. Lab environment is intentionally insecure and only intended for local testing use.
  8. Common setup issues include missing ISO files, insufficient resources, or antivirus interference.
  9. Scripts primarily tested with VMware but can be adapted for other hypervisors.
  10. Contributions such as new scripts or improvements are welcomed through GitHub pull requests.

TAKEAWAYS:

  1. Quickly build a realistic, vulnerable Active Directory lab for penetration testing.
  2. Customize your environment by choosing specific machines and deployment order.
  3. Safely practice common AD attacks like lateral movement and privilege escalation.
  4. Ensure ISO files and system resources are prepared to prevent setup issues.
  5. Engage with the community by contributing improvements or additional scripts.

Explore how to secure AI by attending our Learn Live Series

Source: Microsoft Security Blog Author: Shirleyse Haley URL: https://techcommunity.microsoft.com/blog/microsoft-security-blog/explore-how-to-secure-ai-by-attending-our-learn-live-series/4399703

ONE SENTENCE SUMMARY: Microsoft’s Learn Live webinar series helps IT professionals secure AI environments using Microsoft Purview and Defender for Cloud solutions.

MAIN POINTS:

  1. Learn Live webinar series teaches securing AI applications using Microsoft Security solutions.
  2. Sessions demonstrate practical use of Microsoft Purview and Defender for Cloud tools.
  3. Manage AI data security challenges using Microsoft Purview’s sensitivity labels.
  4. Protect against generative AI data exposure with endpoint Data Loss Prevention (DLP).
  5. Use Microsoft Purview eDiscovery for investigating Microsoft 365 Copilot interactions.
  6. Apply Data Lifecycle Management in Purview to manage Copilot data retention effectively.
  7. Utilize Purview’s Data Security Posture Management (DSPM) to monitor AI interactions.
  8. Detect AI security risks through reports and insights provided by Purview DSPM.
  9. Configure security policies like DLP and sensitivity labels for AI-referenced data protection.
  10. Leverage Microsoft Defender for Cloud for advanced protection of AI workloads.

TAKEAWAYS:

  1. Organizations must proactively address AI-specific security threats and data exposure risks.
  2. Microsoft Purview provides comprehensive tools for data security and compliance management.
  3. Microsoft Defender for Cloud offers advanced threat protection tailored for AI applications.
  4. Hands-on Learn Live sessions demonstrate practical solutions to AI security challenges.
  5. Recorded webinar sessions are available on-demand, ensuring ongoing learning opportunities.

Offline Memory Forensics With Volatility

Source: Black Hills Information Security, Inc. Author: BHIS URL: https://www.blackhillsinfosec.com/offline-memory-forensics-with-volatility/

ONE SENTENCE SUMMARY:

Using memory forensics with Volatility on ESXi snapshots enables stealthy credential extraction and domain escalation during engagements.

MAIN POINTS:

  1. Ben Bowman is a Security Analyst focused on research and tool development at Black Hills Information Security.
  2. Attackers often aim to escalate quickly, but memory forensics offers options when typical paths are blocked.
  3. Volatility can extract SAM hashes from a VM memory snapshot, aiding privilege escalation.
  4. ESXi access allows attackers to take VM snapshots and analyze memory offline.
  5. A cracked IPMI hash can lead to ESXi login and access to hosted virtual machines.
  6. Instead of noisy probing, attackers can extract credentials from a Windows VM snapshot.
  7. Snapshots must include memory to enable effective analysis with Volatility.
  8. Volatility3 setup involves cloning the repository and installing dependencies in a Python virtual environment.
  9. SAM hashes are extracted using the windows.hashdump.Hashdump plugin on the vmem file.
  10. Extracted hashes can be used with netexec to obtain domain account credentials via LSA dumping.

TAKEAWAYS:

  1. Memory forensics offers stealthy alternatives when traditional privilege escalation fails.
  2. Volatility is a powerful tool for extracting sensitive credentials from VM memory.
  3. ESXi environments can be exploited by leveraging VM snapshots for offline analysis.
  4. Proper snapshot configuration is critical—ensure memory is included.
  5. Defending against memory analysis is challenging, making it a valuable technique for red teamers.

Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws

Source: BleepingComputer Author: Lawrence Abrams URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2025-patch-tuesday-fixes-exploited-zero-day-134-flaws/

ONE SENTENCE SUMMARY:

Microsoft’s June 2025 security update addresses critical and important vulnerabilities across Office, Windows, Edge, Azure, and developer tools.

MAIN POINTS:

  1. Over 100 vulnerabilities were disclosed across Microsoft products in June 2025, many rated as Important or Critical.
  2. Microsoft Office, especially Excel and Word, includes multiple Critical remote code execution (RCE) vulnerabilities.
  3. Windows Remote Desktop Services and Kerberos have Critical vulnerabilities allowing remote code execution and privilege escalation.
  4. Several Edge (Chromium-based) flaws involve improper implementation and remote code execution vulnerabilities.
  5. Windows Kernel and NTFS face multiple Elevation of Privilege and Information Disclosure vulnerabilities.
  6. Azure-related services, including Local Cluster and Admin Center, are affected by privilege and information disclosure issues.
  7. Visual Studio and related tools include elevation of privilege vulnerabilities that could affect developer environments.
  8. Windows Media and Telephony Services have multiple RCE vulnerabilities rated as Important.
  9. Windows Subsystem for Linux and BitLocker contain security feature bypass vulnerabilities.
  10. Numerous Denial of Service vulnerabilities exist in Windows components like HTTP.sys, Standards-Based Storage, and MSMQ.

TAKEAWAYS:

  1. Patch Microsoft Office immediately due to multiple Critical remote code execution vulnerabilities in Excel and Word.
  2. Prioritize updates for Windows Remote Desktop Services and Kerberos due to high-risk remote exploits.
  3. Edge browser vulnerabilities highlight the ongoing need for Chromium-based patching and scrutiny.
  4. Elevation of Privilege remains a dominant vulnerability type, affecting kernel, NTFS, and various Windows services.
  5. Regular patching of Azure, Visual Studio, and developer tools is essential to maintain secure development environments.

From Firewalls to AI: The Evolution of Real-Time Cyber Defense

Source: Cisco Security Blog Author: Gogulakrishnan Thiyagarajan URL: https://feedpress.me/link/23535/17001294/from-firewalls-to-ai-the-evolution-of-real-time-cyber-defense

ONE SENTENCE SUMMARY:
AI is revolutionizing cyber defense by replacing static firewalls with intelligent, real-time intrusion detection and response systems.

MAIN POINTS:

  1. AI enhances cyber defense by enabling real-time threat detection and automated response mechanisms.
  2. Traditional firewalls are limited in handling evolving, sophisticated cyber threats.
  3. Machine learning algorithms identify patterns and anomalies that indicate potential intrusions.
  4. AI systems continuously learn from new data to improve threat prediction accuracy.
  5. Real-time analysis allows quicker mitigation of cyber threats before damage occurs.
  6. AI-powered tools can detect zero-day vulnerabilities faster than traditional methods.
  7. Integration of AI with cybersecurity reduces human error and response times.
  8. Behavioral analytics helps in identifying insider threats and compromised accounts.
  9. AI enables proactive defense strategies rather than reactive responses.
  10. Cybersecurity teams benefit from AI-driven insights to prioritize and address critical threats effectively.

TAKEAWAYS:

  1. AI shifts cyber defense from reactive to proactive threat management.
  2. Real-time detection significantly shortens response time to cyber incidents.
  3. Continuous learning improves AI’s ability to detect new and unknown threats.
  4. Automation through AI reduces the workload on human cybersecurity professionals.
  5. Advanced analytics empower organizations to make smarter security decisions.

Google hopes its experimental AI model can unearth new security use cases

Source: CyberScoop Author: djohnson URL: https://cyberscoop.com/google-sec-gemini-experimental-ai-cybersecurity-assistant/

ONE SENTENCE SUMMARY:

Google’s new AI model, Sec Gemini, aims to assist cybersecurity professionals by automating data-heavy tasks and improving threat analysis.

MAIN POINTS:

  1. Google launched Sec Gemini V1 as an experimental AI assistant for cybersecurity professionals.
  2. The model automates tedious data tasks to improve cybersecurity workflows and efficiency.
  3. Sec Gemini uses Google data sources like Mandiant intelligence and open-source vulnerability databases.
  4. It outperforms rival models in threat intelligence understanding and vulnerability root-cause mapping.
  5. Security researchers are invited to test and identify practical use cases for Sec Gemini.
  6. The model updates in near real-time using the latest threat intelligence and vulnerability data.
  7. A 2024 meta-study shows LLMs are already widely used for tasks like malware and phishing detection.
  8. Google will refine Sec Gemini based on feedback from initial non-commercial academic and NGO testers.
  9. Experts warn AI tools should enhance, not replace, human cybersecurity teams.
  10. Google mitigates hallucinations by training Sec Gemini on curated, high-quality threat intelligence data.

TAKEAWAYS:

  1. Sec Gemini aims to reduce manual workload for cybersecurity analysts through AI-driven data analysis.
  2. Early testing access is limited to select organizations for real-world feedback and refinement.
  3. Real-time data ingestion makes Sec Gemini potentially valuable during active incident response.
  4. Combining AI with human expertise is key to maximizing cybersecurity effectiveness.
  5. Google’s curated data approach helps minimize AI hallucinations, enhancing model reliability.

FogSecurity/yes3-scanner: YES3 Scanner: S3 Security Scanner for Access and Ransomware Protection

Source: GitHub Author: unknown URL: https://github.com/FogSecurity/yes3-scanner

ONE SENTENCE SUMMARY:

YES3 is a Python-based tool that scans AWS accounts for S3 bucket misconfigurations, focusing on access, security, and ransomware protection.

MAIN POINTS:

  1. YES3 scans AWS S3 buckets for access, encryption, and security misconfigurations.
  2. Detects public access via ACLs, policies, and website settings.
  3. Checks for preventative settings like Public Access Block and disabled ACLs.
  4. Identifies additional security configurations like encryption and server access logging.
  5. Evaluates ransomware protection through Object Lock and versioning.
  6. Outputs detailed reports of potential issues per bucket.
  7. Requires Python 3, boto3, and proper AWS IAM permissions to run.
  8. Scans globally with region input for quota checks via Boto3 client.
  9. Offers a private beta for multi-account and object-level scanning.
  10. Installation is via pip and requirements.txt; virtual environments are supported.

TAKEAWAYS:

  1. YES3 helps secure S3 by identifying misconfigurations and potential vulnerabilities.
  2. Reports include granular bucket-level security details for actionable insights.
  3. Public access detection spans multiple configurations including ACLs and policies.
  4. Additional features like Object Lock and lifecycle policies enhance ransomware protection.
  5. The tool is actively developed, with expanded functionality planned for future releases.