Maximus IT

11 Open-Source Repos to Put Between Your Code and Production

2026-11-06T07:06:41.839+11:00

11 Open-Source Repos to Put Between Your Code and Production

We're shipping code faster than ever. Attackers, now with AI on their side, are finding bugs faster than ever too.

The one thing that hasn't sped up is the security review.

That gap is where incidents live. So here's a practical list: 11 open-source repos I'd put between your code and production, grouped roughly by where they fit in the pipeline.

AI-Assisted Security Review

1. Cloudflare Security Audit : github.com/cloudflare/security-audit-skill

Your coding agent runs a multi-phase audit, and every finding is verified before it's reported. Less noise, fewer hallucinated vulnerabilities .

2. Claude Code Security Review : github.com/anthropics/claude-code-security-review

A security review on every pull request, before a human even opens it .

3. Strix : github.com/usestrix/strix

AI agents that pentest your own app and help you fix what they find.

Securing the Agent Supply Chain

4. NVIDIA SkillSpector : github.com/NVIDIA/SkillSpector

Scans agent skills for prompt injection and data exfiltration before you install them. If your team is pulling in third-party agent skills, this is table stakes .

Static Analysis & Secrets

5. Semgrep: github.com/semgrep/semgrep

Write a rule once, catch the same bug in every file it appears.

6. Gitleaks: github.com/gitleaks/gitleaks

Stops secrets before they reach a commit .

7. TruffleHog: github.com/trufflesecurity/trufflehog

Finds leaked credentials and checks whether they still work. That last part matters a dead key is noise, a live one is an incident .

Dependencies & CI/CD

8. OSV-Scanner by Google : github.com/google/osv-scanner

Flags dependencies with known vulnerabilities. Most of your code is someone else's .

9. zizmor : github.com/zizmorcore/zizmor

Finds the holes in your GitHub Actions, where supply-chain attacks love to start .

Production & LLM Apps

10. Nuclei : github.com/projectdiscovery/nuclei

Scans what's actually running in production for known CVEs and misconfigurations .

11. garak by NVIDIA : github.com/NVIDIA/garak

Throws jailbreaks and prompt injections at your LLM app before real users do.

None of these replace a security engineer. They catch the obvious mistakes, so humans can focus on the hard ones.

That's the whole point: automate the floor, so the people you trust can work on the ceiling.

If you're adopting AI-assisted development, the review side has to keep pace. Pick two or three from this list that fit your stack, wire them into CI this week, and iterate from there.

#AI #codereview #scan #Agent #security engineering #cybersecurity #cyber #LLM

When the Freezer Becomes the Weapon: What Two August 2026 Reports Tell Us About OT Exposure

2026-11-05T16:36:27.940+11:00

In August 2026, two separate research efforts landed within ten days of each other. Read together, they describe one problem, not two.

The first was an attack on commercial refrigeration systems. Internet-exposed Danfoss AK-SM 800A and related cold-chain controllers - the kind that run freezers and display cases in supermarkets and warehouses - were forced into continuous defrost and heating cycles. Temperatures inside cabinets climbed to 50°C–80°C. The result: massive food spoilage, equipment fires, and water damage from sprinklers going off, across hundreds of retail locations in Europe and beyond.

The second was a joint advisory from NSA, CISA, FBI, DOE and EPA on AI-assisted attacks against Siemens S7 series PLCs - the controllers that run industrial processes. That advisory names no malware, no attacker, and no indicators. What it describes is preparation: attackers finding exposed controllers through internet search engines, generating working attack tools with AI assistance, and reading controller data to understand the process. The agencies assess the activity as reconnaissance and pre-positioning — reads today, writes tomorrow.

Why they belong in one conversation: the refrigeration attack shows what happens when someone reaches an exposed controller. The Siemens advisory shows that the same access path is being walked against far more consequential hardware. Both start at the same place: a controller the internet can see, with authentication nobody configured.

The Refrigeration Attack, Plainly, The controllers at the center of this - Danfoss AK-SM 800A and legacy AK-SC355 series, plus platform parallels like Copeland/Dixell XWEB - are centralized managers for refrigeration equipment. From one web console, an administrator can monitor circuits, set temperature thresholds, adjust operating schedules, and configure alerts. Convenient for remote technicians. Also convenient for anyone else who finds the console.

Claroty's researchers found three flaws in that web interface:

· A hidden login backdoor. A "code of the day" mechanism, apparently built for vendor support, generates a daily password from the device's own clock. Reproduce the math, reproduce the credential. No administrator password needed.

· A command injection flaw in the email configuration page that lets an authenticated attacker run operating-system commands — full remote code execution.

· A web server configuration injection that lets an authenticated user redirect traffic and crash the management interface on demand.

Before any of that mattered, the researchers did something simpler: they searched Shodan and Censys for these devices. They found thousands of management interfaces directly reachable from the public internet, many advertising the Danfoss StoreView banner for anyone to see.

The attack path that followed is not sophisticated. Find exposed controllers. Bypass or guess the login. Change the defrost and heating schedules. Wait.

That last step is the part worth sitting with. The attackers did not need to write malware or develop an exploit chain. They changed a schedule on a system that was designed to be changed remotely, and the physical world did the rest.

The Siemens Advisory, The August 19 advisory describes a different protocol and a different objective, but the same philosophy.

Siemens S7 PLCs - the S7-200, 300, 400, 1200 and 1500 families, including safety controllers - listen on TCP port 102. Many of them are reachable from the internet, and many have authentication that is unconfigured, default, or minimal. The advisory states that access frequently requires no exploitation at all.

What the attackers do once inside is patient. They enumerate the controller, read its data blocks to understand the process, and stay. The agencies are explicit that read access is being used as preparation for future write operations — which means a read-only finding is not a reassurance. It is an early warning.

Two details from that advisory matter for anyone building detection:

AI has lowered the skill floor. The advisory states plainly that AI dramatically reduces the technical skill and time required to produce working industrial-control exploitation scripts. The old comfort - only a nation-state could do this - no longer holds. Moderate criminal groups, access brokers, and hacktivists can now generate functional tooling from public documentation.

The tooling is designed to look boring. Attackers build on snap7, a legitimate open-source library used by real engineers. The traffic is well-formed. The scripts are named to look like monitoring software. Nothing about the tool itself stands out. The only reliable signal is context: which machine it runs on, and whether anyone authorized it.

What This Means for Your Organization

The uncomfortable finding here is not the malware. It is the exposure.

Every question in this hunt reduces to two:

1. Can the internet see our controllers?

2. Do we have an authorization record for this session?

If the answer to the first is yes, the second question becomes urgent. And there is a reason you may not know the answer: the Siemens advisory notes that organizations working with third-party integrators and service providers frequently do not realize their systems are exposed. A controller sitting on your integrator's address space is still your controller. The refrigeration campaign hit hundreds of retail locations — exactly the kind of estate where IT is delegated, sites are acquired, and no one holds a central exposure register.

There is also a physical-consequence lesson. The refrigeration attack was not a data breach. It was spoiled inventory, fires, and water damage. In OT, a configuration change is a physical event. That changes who needs to be in the room: operations, facilities, and safety engineering - not just the SOC.

What to Hunt For (High Level)

You do not need to start with packet analysis. Start with the two questions above.

First, look at what the internet can see. Passive queries against Shodan, Censys and Netlas for Danfoss StoreView interfaces and Siemens port 102 services, scoped to your public address space. This is read-only - never scan your own controllers to answer it, because active probing of a live controller carries real process risk. Attribute every hit carefully. An unattributable result is inconclusive, not clean.

Second, build two lists you probably don't have:

· A controller inventory with model and firmware version per device. Anything below Danfoss firmware R4.3.1 is presumptively vulnerable to all three flaws.

· An approved engineering workstation register. This is the single most important artifact in the hunt. Legitimate engineering software and attacker tooling look nearly identical on the wire. The only durable difference is whether the machine is supposed to be doing that job - and whether an approval record exists.

Third, look for the behaviors, not the signatures. Neither source publishes indicators, so there is nothing to sweep for. What you can look for:

· Connections to port 102 from hosts outside the approved engineering set

· One source reaching many controllers in sequence — the shape of scanning

· Python or script interpreters talking to controllers

· Processes named like monitoring or telemetry software that don't match a known product

· Web requests to the Danfoss management endpoints tied to the three flaws, outside a change window

· Refrigeration schedule and setpoint changes that don't match a work order - this is the actual sabotage signature, and it lives in configuration history, not in packets

Fourth, correlate any write or schedule change to a physical effect. A parameter change followed by a temperature excursion or an alarm flood converts a network observation into demonstrated operational impact. That changes escalation, and it may change reporting obligations.

What to Fix

Do these now:

1. Patch the cold chain. Danfoss fixed the core flaws in firmware R4.3.1. Confirm patch parity for legacy AK-SC355 units and parallel platforms.

2. Get controllers off the public internet. Vendors and CERT-FR both recommend disconnecting management consoles from direct internet access. Put cold-chain and process-control gear behind segmented local networks with VPN or zero-trust access. This single control defeats the initial-access path in both campaigns.

3. Sweep for default and unconfigured authentication on every controller, including hidden vendor-support mechanisms.

4. Audit firewall rules toward port 102 and controller management ports - including old rules and rules owned by integrators.

5. Extend the exposure audit beyond your own address space. Include integrator, MSP, acquisition and franchise estates.

Do these next:

6. Keep gold-copy project files and known-good configuration snapshots for every controller. Without a baseline, change detection is guesswork.

7. Retain full-payload packet capture on port 102 and controller management interfaces as a standing capability. Function codes cannot be recovered after the fact from flow data.

8. Retire default SNMP community strings on OT assets.

9. Build a change-record correlation workflow so every write or schedule change can be matched to an authorization in near-real-time.

10. Inventory and constrain third-party access - MFA on vendor paths, and contractual notification when an integrator exposes a controller on its own network.

The Bottom Line

Two reports, ten days apart, one message.

The refrigeration campaign is the proof of impact: exposed controllers, weak authentication, physical consequences at scale, in an industry that assumed it wasn't a target.

The Siemens advisory is the warning: the same access path is being used against process-control hardware with far higher stakes, by actors using AI to close the gap between a published weakness and a working tool - and doing so patiently, with reads that the agencies assess as preparation for writes.

The defensible position is not a better signature. It is knowing what you have, knowing what the internet can see of it, knowing who is authorized to talk to it, and having a record that proves it. Everything else in this hunt is downstream of those four things.

References

1. Claroty Team82, "Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers," August 9, 2026.

2. NSA/CISA/FBI/DOE/EPA Joint Advisory AA26-231A, "AI-Assisted S7comm Exploitation and Internet-Exposed Siemens S7 Series PLCs," August 19, 2026.

3. 1898 & Co. Advisory, "Threat Hunt Plan: Siemens S7 Series PLCs," August 19, 2026.

4. CERT-FR guidance on cold-chain controller exposure and network isolation.

5. CISA Known Exploited Vulnerabilities catalog.

Threat Hunt: Cold-Chain Controllers as a Pre-Positioning Target - Danfoss AK-SM 800A Exploitation and the Siemens S7 Overlap

2026-11-05T16:27:29.454+11:00

Hunt window: 12 months (90-day minimum) | Status: Behavioral

Two reports published days apart in August 2026 describe attacks that, read together, represent a single operational pattern rather than two unrelated incidents.

The first is the reported sabotage campaign against commercial refrigeration systems, in which internet-exposed Danfoss AK-SM 800A and AK-SC355 controllers - and platform parallels such as Copeland/Dixell XWEB systems - were forced into continuous defrost and heating cycles, driving cabinet temperatures to 50°C–80°C. The result was food spoilage at scale, equipment fires, and secondary water damage from activated sprinklers across hundreds of retail locations in Europe and beyond. The entry vector was not sophisticated: the controllers were simply reachable from the internet, and Claroty Team82 had already documented three vulnerabilities (CVE-2025-41450, -41451, -41452) that make an exposed management interface an administrative compromise waiting to happen.

The second is the August 19, 2026 joint advisory from NSA, CISA, FBI, DOE and EPA (AA26-231A) on AI-assisted exploitation of Siemens S7 Series PLCs. That advisory names no CVE, no actor, and no indicators. What it describes is capability development: threat actors querying third-party scan indexes rather than scanning themselves (T1596.005), generating working S7comm exploitation scripts with AI assistance, building tooling on the legitimate snap7 library and masquerading it as OT monitoring software (T0849), and gaining access to controllers whose authentication is unconfigured or default. The agencies assess the activity as persistent reconnaissance and pre-positioning — reads today, writes tomorrow.

Why these belong in one hunt: the cold-chain sabotage demonstrates what the S7 campaign is preparing for, on a different protocol. Both attacks start at the same place - a controller that the internet can see and that nobody authenticated properly. The refrigeration incident is the proof of impact; the S7 advisory is the warning that the same access path is being walked against process-control hardware with far higher consequences.

The uncomfortable finding is not the malware. It is the exposure. Every hypothesis in this plan ultimately reduces to two questions: can the internet see our controllers? and do we have an authorization record for this session? A hunt that waits for a signature from either report will find nothing, because neither report publishes one.

Target Platforms and Attack Surface

Platform Role Relevant Finding

Danfoss AK-SM 800A Centralized refrigeration system manager with embedded web UI CVE-2025-41450, -41451, -41452; thousands exposed on Shodan/Censys showing the StoreView banner

Danfoss AK-SC355 series Legacy cold-chain controller Affected in the same campaign; patch parity with R4.3.1

Copeland/Dixell XWEB Platform parallel in refrigeration/BMS Named in the campaign reporting; apply the same exposure logic

Siemens S7-200/300/400/1200/1500 PLCs, incl. F-series safety AA26-231A: scan-index targeting, snap7 tooling, default/unconfigured auth

Engineering workstations, jump hosts, historians Level 3/3.5 paths to TCP 102 The credential and tooling staging ground

Integrator / MSP address space Third-party remote access Advisory AA26-231A: asset owners frequently unaware their systems are exposed

The Danfoss Vulnerability Chain

· CVE-2025-41450 - Code-of-the-Day authentication bypass. A hidden, vendor-support-oriented mechanism generates a daily password from the device's current date and time. Reproduce the algorithm, reproduce the credential. Successful exploitation yields a fully authenticated administrative session without knowing the administrator password.

· CVE-2025-41451 - SMTP configuration command injection → RCE. The email authentication password field is formatted into an OS shell command without sanitization, reaching the underlying operating system as the web application's privilege level.

· CVE-2025-41452 -Authenticated Nginx headers.conf injection. Arbitrary routing directives can be implanted into the internet-facing web server, manipulating client traffic and — through an unhandled exception in sm_app — producing a repeatable denial of service against the management interface.

The attack mechanics observed in the campaign map cleanly onto this chain: scan for exposed StoreView interfaces → bypass authentication (code-of-the-day, default admin, or date-derived logic) → modify internal schedules and parameter sets → lock the plant into defrost/heating until the food is ruined.

The Siemens Overlap

AA26-231A describes a different protocol and a different objective, but the same access philosophy. Controllers reachable on TCP 102 with authentication unconfigured or minimally configured are entered without exploitation at all. Once inside, the actor enumerates the CPU (BlockList 0x2F, GetBlockInfo 0x31, GetDiagData 0x32), reads data blocks to understand the process (T0893), and retains access. The advisory's assessment is explicit: reads are preparation for writes.

The snap7/python-snap7 tooling is the connective tissue that matters for detection. It is a legitimate open-source library. The traffic it produces is well-formed S7comm. The scripts are AI-generated and named to look like monitoring software. No single observable discriminates it — the durable discriminator is context: which host, whether that host is an approved engineering workstation, and whether an approval record exists.

Hunt Hypotheses and Procedures

Scoping note on protocol coverage. TCP 102 carries both S7comm and IEC 61850 MMS, distinguished by the protocol-ID byte in the COTP payload (0x32 classic S7comm, 0x72 S7CommPlus, neither for MMS). A port-only query conflates them at sites running both. On S7-1200/1500 programmed via TIA Portal, S7CommPlus body contents are session-keyed and semantically opaque on modern firmware — treat 0x72 volume to a CPU as a programming-session indicator and fall back to connection-level evidence. Stating this up front prevents a clean negative from being read as absence of activity.

Out of scope: any active interrogation of a controller. No port scanning, no S7comm probing, no COTP connection requests, no authentication attempts, no active-query module pointed at an S7 or Danfoss device. Active queries carry genuine process risk — on a refrigeration controller mid-defrost, that risk is measured in inventory. The external-exposure leg reads third-party scan indices only and never touches target infrastructure.

Hypothesis 1 — Internet Exposure (Execute FIRST)

Statement: An external actor can identify an internet-exposed Danfoss or Siemens controller belonging to the organization through a third-party scan index, observable as exposed services in those indices.

MITRE ATT&CK: T1596.005 (Search Open Technical Databases: Scan Databases) | T1133 (External Remote Services) | ICS T0883 (Internet Accessible Device) | ICS T0846 (Remote System Discovery)

This is the advisory's own first technique. The actors read the same index the defender reads. Execute this hypothesis first — its output scopes everything below.

Collection — Danfoss surface (passive only):`

http.title:"StoreView"

http.html:"Danfoss" http.title:"AK-SM"

product:"Danfoss" port:80,443

ssl.cert.subject.CN:"<your_domain>" port:443

net:<your_public_CIDR> http.title:"StoreView"

org:"<Your Org Name>"

```

Collection — Siemens surface (passive only):

```

port:102 "Siemens"

product:"Siemens S7" port:102

port:102 net:<your_public_CIDR>

port:102 asn:AS<your_ASN>

ssl.cert.subject.CN:"<your_domain>"

```

Censys CenQL — author the nested host.services.* form so criteria hold on the same service object; never the deprecated legacy CSL form:

```

host.services: (port = "102" and software.vendor: "Siemens")

host.services: (port = 80 or port = 443) and host.services.software.product: "StoreView"

host.services.port = "102" and (host.autonomous_system.asn = <your_ASN> or host.ip: "<your_public_CIDR>")

```

Netlas — tie-breaker only, when Shodan and Censys disagree.

Analysis requirements:

1. Attribute every hit with at least two independent ownership signals - PTR, ASN, certificate CN/SAN, WHOIS/RDAP, your cloud and public-IP inventory. Shared hosting, carrier NAT and integrator-owned space break attribution in both directions. An unattributable hit is inconclusive, not negative.

2. Version-triage each Danfoss banner against R4.3.1. Anything below R4.3.1 is presumptively vulnerable to all three CVEs. For Siemens, capture 6ES7 order numbers from S7 banners to pin the exact CPU variant.

3. Corroborate in at least two engines before escalating. Absence from an index is evidence only that the index did not observe the host.

4. Historical pivot. Because target selection is performed by reading a scan index, continuous exposure means the asset has been on a published target list for the entire period. Establish how far back the exposure extends and treat it as presumptively enumerated.

5. Cross-reference the CISA KEV catalog. A KEV match on the controller or a co-resident service converts exposure into presumptive initial-access risk. Rank by ransomware ratio, not entry count.

6. Pivot hard. Every confirmed-owned exposed controller becomes a priority target hunted exhaustively under Hypotheses 2–4, with full conversation history reviewed rather than sampled.

Integrator-owned space deserves specific attention. A refrigeration controller exposed on a service provider's address range is still your controller, and the advisory identifies the integrator relationship as the reason asset owners are frequently unaware of their exposure. Where the public-IP inventory is incomplete, say so in the report rather than implying coverage.

Favicon-hash pivoting is available for stripped banners, but derive the hash passively from an index-computed value on an instance you own — never by fetching /favicon.ico from a target, and never by copying a hash from a third-party write-up, which silently hunts an unrelated population. API keys referenced by environment variable only (SHODAN_API_KEY, CENSYS_API_SECRET, NETLAS_API_KEY); a missing key is non-blocking — record the coverage gap.

Hypothesis 2 - Internal Reconnaissance Against Controllers

Statement: An actor has conducted reconnaissance against Danfoss or Siemens controllers from inside the environment, observable as sequential connection attempts across multiple addresses, programming-device role COTP connection requests, S7comm enumeration functions, or HTTP requests to .cgi endpoints (xml.cgi?action=getauth, load_nginx_headers) from hosts that are not sanctioned engineering workstations.

MITRE ATT&CK: ICS T0846 (Remote System Discovery) | ICS T0893 (Data from Local System) | T1694 (Insecure Credentials) | T1046 (Network Service Discovery)

Falcon LogScale (CQL) — baseline port 102 conversation map. Everything outside the sanctioned set is the hunt:

```

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

| groupBy([aid, ComputerName, LocalAddressIP4, RemoteAddressIP4], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — sequential scanning. A legitimate engineering workstation talks to a small, stable set of CPUs; a scanner talks to many:

```

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

| groupBy([aid, ComputerName], function=count(RemoteAddressIP4, distinct=true, as=UniqueTargets), limit=max)

| UniqueTargets > 5

| sort(UniqueTargets, order=desc, limit=max)

```

CQL — process attribution for port 102. NetworkConnectIP4 carries no ImageFileName; the reverse-direction join keeps the subquery under the row cap. Run at 90d or longer — long-running SCADA and historian daemons may predate a shorter window:

```

#event_simpleName = ProcessRollup2

| join({

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)

| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — hosts consulting the same scan indices the actors use:

```

#event_simpleName = DnsRequest

| DomainName = /(censys|zoomeye|shodan)/i

| join({#event_simpleName = /ProcessRollup2/},

field=[aid, ContextProcessId], key=[aid, TargetProcessId], mode=left,

include=[ImageFileName, CommandLine, UserName])

| groupBy([ComputerName, DomainName, ImageFileName, UserName], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

Packet capture — full payload, non-negotiable. COTP TSAPs and S7 function codes live inside the payload; a truncated capture cannot decode them. The -G rotation requires a strftime format in the -w filename or each rotation overwrites the last; -C counts in units of 1,000,000 bytes:

```

tcpdump -i eth1 -nn -s 0 -G 3600 -C 500 -w /captures/s7_%Y%m%d_%H%M%S.pcap 'tcp port 102'

tcpdump -i eth1 -nn -s 0 -w /captures/s7_cotp_cr.pcap 'tcp port 102 and tcp[((tcp[12] & 0xf0) >> 2) + 5] = 0xe0'

```

Danfoss-specific collection. The web interface is the realistic entry point, so hunt it at the HTTP layer where S7 hunting happens at the protocol layer. Pull proxy, reverse-proxy and web server logs for every path carrying the controller management interface and query for the endpoint patterns from the Claroty research:

· xml.cgi with action=getauth — the authentication handler. Requests containing the two hidden redacted attributes that divert to check_code_of_day are the bypass in progress.

· load_nginx_headers — the CVE-2025-41452 file-upload endpoint. Any invocation outside a documented maintenance window is a finding.

· SMTP configuration updates touching the email authentication password field - the CVE-2025-41451 injection point.

Windows Event IDs on engineering workstations, jump hosts, and any Level 3 host with a route to port 102: 4688 (process creation with command line), 4104 (PowerShell script blocks), 5156 (WFP permitted connection - the host-side record of every outbound session), 5158 (WFP bind to local port — listeners and tunnels), 7045 (new service), 4624/4625 (logon attribution).

PowerShell - rarity ranking of port 102 talkers from the host firewall record:

```powershell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156; StartTime=(Get-Date).AddDays(-90)} |

ForEach-Object { $x=[xml]$_.ToXml(); [pscustomobject]@{

Time=$_.TimeCreated; Host=$_.MachineName

App=$x.Event.EventData.Data[1].'#text'

DestIP=$x.Event.EventData.Data[5].'#text'

DestPort=$x.Event.EventData.Data[6].'#text' } } |

Where-Object { $_.DestPort -eq '102' } |

Export-Csv -NoTypeInformation C:\hunt\s7_port102_5156.csv

```

OT platform collection - the conversation record, not the endpoint list:

· Claroty xDome - Network > Communication > Communication Analysis. Leave Side A empty; Side B = Manufacturer "Siemens AG" or "Danfoss" (or the network carrying the controllers); Communication = Port 102 (and HTTP/HTTPS for Danfoss); Time Frame = Past Quarter. Use Client/Server rather than Direction to identify the true initiator, since Direction matches bidirectional flows. Scope by Network or VLAN rather than Category, because category-scoped clauses miss misclassified assets. Reconcile exported session and byte counts against an independent source — xDome under-reports both silently.

· Claroty CTD - retains continuous full PCAP that xDome does not. Pull the retrospective capture for every segment carrying port 102 and the Danfoss management VLANs across the full hunt window, and export through the CTD-only /v1/events/<id>/pcap surface for offline decoding. Do not treat CTD and xDome results as interchangeable.

· Nozomi Guardian - N2QL against the links table, which is where traffic lives (nodes returns endpoints, not conversations). Bound every query, because head with no argument silently returns 10 rows; use the $ prefix for field-to-field comparison or the query returns a clean-looking nothing:

```

links | where protocol == "s7" | join nodes to ip | join nodes from ip | head 1000

links | where time >= days_ago(90) | where from_zone != to_zone | head 1000

nodes | where vendor == "Siemens" and type == "PLC" | head 1000

nodes | where vendor == "Danfoss" | head 1000

```

· Dragos Platform - Communications Hub, source zone = Level 3/3.5, destination zone = Level 2/1, protocol filter S7comm, 90-day window. Pivot every cross-Purdue session to its asset record and event PCAP. Query the Industrial Protocols QFD for S7 function-code activity outside maintenance windows, and check the Knowledge Pack version before concluding an absent detection is a capability gap rather than a stale pack.

· Armis Centrix - ASQ on ipConnections; omit the boundary literal on first pass and set the time window in the UI picker rather than the query body:

```

in:ipConnections serverPort:102

in:ipConnections serverPort:102 endpointA:(networkLocation:"External")

in:activity type:"Port Scan Detected"

```

· Forescout eyeInspect — filter-driven, no analyst query language; export asset, alert and vulnerability data through the REST API or forward by syslog/CEF and hunt in the SIEM (the OT Network Security Monitoring App for Splunk with its CIM-mapped OT Asset Data Model is the canonical pattern). Leave ICS Patrol active queries disabled for S7 and Danfoss devices for the duration.

· Tenable One OT Exposure — Inventory > All Assets is both the view and the export point; filter to Siemens and Danfoss assets. Events carries policy violations including PLC Start/Stop and Project Upload — the platform's native expression of Hypothesis 4. All programmatic access is GraphQL at /graphql; OT Security has no REST /api/v1/ endpoints and pyTenable is the supported wrapper. Do not enable active queries against controllers during this hunt.

Analysis — rarity and temporal anomaly. A source-destination pair seen once is the shape of reconnaissance; frequent pairs are the operational baseline. The advisory calls out off-hours S7comm and connection patterns consistent with automated scripting rather than human operators:

```

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

| formatTime(format="%H", as=HourOfDay)

| in(HourOfDay, values=["00","01","02","03","04","05","22","23"])

| groupBy([ComputerName, RemoteAddressIP4, HourOfDay], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

Wireshark — the S7comm semantic layer. These decode what connection-level queries can only count, and are the only way to separate a read from a write:

```

s7comm.param.func == 0x2f # BlockList — enumeration

s7comm.param.func == 0x31 # GetBlockInfo

s7comm.param.func == 0x32 # GetDiagData

cotp.dst-tsap

s7comm-plus

```

The destination TSAP in a COTP connection request decodes to the rack and slot of the addressed CPU; the source TSAP carries a role hint — 0x01 programming device, 0x02 operator panel, 0x10 HMI. A client presenting a programming-device role TSAP that is not the sanctioned engineering workstation is a finding on its own, regardless of what functions followed:

```

tshark -r /captures/s7_20260819_000000.pcap -Y 'cotp.type == 0x0e' -T fields -e ip.src -e ip.dst -e cotp.src-tsap -e cotp.dst-tsap

```

SNMP polling. Poll the switch port facing each controller and diff at 60-second intervals across the window. Above 1 Gbps the 32-bit counters wrap — use 64-bit high-capacity counters. AA26-231A calls for removing or changing default community strings: treat any device still answering a default community as a finding in its own right, and any -v1/-v2c access to an OT asset likewise, since those transit essentially in cleartext (RFC 3410 recommends v3 authPriv). Provision credentials via snmp.conf or createUser rather than inline, which leaves passphrases visible in the process table.

Collect trap logs and flag coldStart (1.3.6.1.6.3.1.1.5.1) and warmStart (.2) — these correspond directly to the PLCColdStart/PLCHotStart operations hunted under Hypothesis 4 — plus linkDown/linkUp (.3/.4) for port flaps and authenticationFailure (.5) for unauthorized access attempts.

Hypothesis 3 — AI-Generated snap7 Tooling, Masqueraded as OT Monitoring Software

Statement: An actor has deployed AI-generated tooling built on snap7/python-snap7 onto a host in the environment, masqueraded as legitimate OT monitoring software, observable as Python or compiled processes importing snap7 and speaking S7comm from hosts that are not approved engineering workstations.

MITRE ATT&CK: ICS T0834 (Native API) | ICS T0849 (Masquerading) | T1587.004 (Develop Capabilities: Exploits) | T1588.007 (Obtain Capabilities: Artificial Intelligence)

This is the hardest hypothesis to run cleanly, and it is worth being explicit about why. snap7 and python-snap7 are legitimate, widely used libraries. The traffic is well-formed S7comm, indistinguishable from ordinary engineering activity. The tools are named to look like monitoring software. Neither the library, the protocol, nor the process name is a reliable discriminator alone. The only durable discriminator is context: which host, whether that host is an approved engineering workstation, and whether an approval record exists. Build the approved-workstation inventory first and negate it -never allowlist by hostname pattern inside the query itself.

CQL — direct library references:

```

#event_simpleName = ProcessRollup2

| CommandLine = /snap7/i

| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — library loaded as a module. Confirm the ModuleLoad event name against the tenant's event catalog before treating a zero as a negative:

```

#event_simpleName = ModuleLoad

| ImageFileName = /snap7/i

| groupBy([ComputerName, ImageFileName], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — Python processes that actually spoke to a controller. Far more selective than either signal alone:

```

#event_simpleName = ProcessRollup2

| ImageFileName = /(python|pythonw)\.exe$/i

| join({

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)

| groupBy([ComputerName, UserName, CommandLine], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — the masquerading signal directly. Processes named like monitoring software that speak S7comm. Review every result by hand — the point is not that the name is suspicious but that the combination warrants attribution to a known product:

```

#event_simpleName = ProcessRollup2

| join({

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)

| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — tooling arriving on disk, with hashes for pivoting:

```

in(field=#event_simpleName, values=["NewScriptWritten","PeFileWritten","NewExecutableWritten"])

| TargetFileName = /snap7/i

| groupBy([ComputerName, TargetFileName, SHA256HashData], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — the legitimate Siemens engineering population, which defines the baseline:

```

#event_simpleName = ProcessRollup2

| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

Windows Event IDs: 4688, 4104, 7045, 4697 (service installed, where audit policy provides it).

```powershell

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-365)} |

Where-Object { $_.Message -match 'monitor|telemetry|collector|agent|s7|snap7' } |

Select-Object TimeCreated, MachineName, Message |

Export-Csv -NoTypeInformation C:\hunt\masq_services_7045.csv

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddDays(-90)} |

Where-Object { $_.Message -match 'snap7|102|TcpClient|Socket' } |

Select-Object TimeCreated, MachineName, Message |

Export-Csv -NoTypeInformation C:\hunt\s7_scriptblocks_4104.csv

```

OT platform collection:

· Claroty xDome - Applications filter chip on the Devices surface enumerates installed software on engineering workstations, requiring the Edge or Endpoint Sensor; where only network visibility exists, fall back to Device Type "Industrial Workstation" + Manufacturer "Siemens AG" + OS Category "Windows" to bound the population.

· Dragos - the optional Active Collection agent adds software/module inventory to the Assets record; without it, Dragos sees the S7comm traffic but not the library. Register a validated pattern as a custom analytic through the analytic manager so it becomes standing detection content.

· Nozomi Guardian - the Arc host agent covers the OT-locked Windows/Linux workstations an IT EDR cannot reach, collecting process execution with image path, command line, parent and hashes, plus USB and file events. On hosts where the OEM forbids third-party agents, network-only visibility is the ceiling - record it as a coverage gap.

· Tenable One OT Exposure - the asset record carries installed-software and module data where credentialed collection is configured. Join to the port 102 talker list on asset ID rather than IP address, since addresses churn in OT.

· Armis - no host-agent view of loaded libraries; scope the device population and correlate against Falcon/Arc endpoint evidence.

YARA filesystem sweep - engineering workstations, jump hosts, Level 3 hosts with a route to port 102:

```

yara -r /opt/hunt/rules/s7_hunt.yar /home/ /opt/ /tmp/ /var/tmp/ >> /opt/hunt/hits_tooling.txt

yara -r C:\hunt\rules\s7_hunt.yar C:\Users\ C:\ProgramData\ C:\Windows\Temp\ >> C:\hunt\hits_tooling.txt

```

YARA memory scan. Classic YARA 4.5 takes the PID as a positional argument — there is no -p flag for process scanning, and YARA-X cannot scan process memory at all:

```bash

for p in $(pgrep -f 'python|s7|snap7'); do yara /opt/hunt/rules/s7_hunt.yar $p >> /opt/hunt/mem_hits.txt; done

```

```powershell

Get-Process | Where-Object { $_.ProcessName -match 'python|s7|monitor' } | ForEach-Object { & yara.exe C:\hunt\rules\s7_hunt.yar $_.Id >> C:\hunt\mem_hits.txt }

CrowdStrike Falcon RTR executes these scans on remote hosts without an on-site analyst, and a validated pattern can be promoted to a Custom IOA so the finding becomes standing detection content.

Analysis : rarity of the process population that touches port 102. A single-occurrence image name in this list deserves individual attribution:

#event_simpleName = ProcessRollup2

| join({

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)

| groupBy([ImageFileName], function=count(as=cnt), limit=max)

| sort(cnt, order=asc, limit=max)

```

Wireshark — distinguish tooling from genuine engineering software by session construction. Legitimate TIA Portal sessions against S7-1200/1500 use S7CommPlus and negotiate a session key; snap7 speaks classic S7comm. A host speaking classic S7comm to an S7-1500 that the site otherwise programs exclusively through TIA Portal is a strong signal — it indicates a client that is not the engineering software:

```

s7comm and not s7comm-plus

s7comm.param.setup.pdu_length

cotp.src-tsap

```

Hypothesis 4 Write, Program-Transfer, or CPU-State Operations (and Refrigeration Parameter Tampering)

Statement: An actor has issued write, program-transfer, CPU-state, or refrigeration-schedule/parameter operations against a controller, observable as S7comm function codes outside the read set, or Danfoss configuration changes altering defrost/heating schedules, arriving from an unsanctioned source or outside an approved change window.

Falcon and Datadog cannot see S7 function codes - they see that a connection occurred, not what it carried. This hypothesis runs primarily on packet capture and the OT platforms, with endpoint telemetry supplying attribution for whichever host the network evidence implicates.

The controlling S7comm function codes:

Code Function Significance

0x05 WriteVar Parameter/data write — T0836

0x1A / 0x1B / 0x1C RequestDownload / DownloadBlock / DownloadEnded Program download — T0843

0x1D / 0x1E / 0x1F StartUpload / UploadBlock / EndUpload Program upload — T0845

0x28 PIService —

0x29 PLCStop T0813 Denial of Control

0x2B / 0x2C PLCHotStart / PLCColdStart T0816

The read set is the baseline; everything else warrants a change-record correlation. In the UserData family, watch the Security and CpuPassword exchanges, which precede authentication bypass or password attacks, and SetClock, which alters the CPU clock and can defeat time-based logic or obscure a timeline.

Packet capture - full payload mandatory, because the function code sits inside the S7 parameter block:

```

tcpdump -i eth1 -nn -s 0 -G 1800 -C 500 -w /captures/s7_full_%Y%m%d_%H%M%S.pcap 'tcp port 102'

tcpdump -i eth1 -nn -s 0 -w /captures/s7_job.pcap 'tcp port 102 and tcp[((tcp[12] & 0xf0) >> 2) + 7] = 0x32'

```

Wireshark - the write, transfer and CPU-state codes this hunt exists to find:

```

s7comm.param.func == 0x05

s7comm.param.func == 0x1a or 0x1b or 0x1c or 0x1d or 0x1e or 0x1f

s7comm.param.func == 0x28 or 0x29 or 0x2b or 0x2c

```

Pair every request to its acknowledgement by PDU reference. A job that was issued is an attempt; a job whose AckData returns error class 0x00 is a completed operation, and the severity is materially different. An error class of 0x87 indicates access or protection denial - itself evidence of authentication probing against a controller:

```

tshark -r /captures/s7_full_20260819_000000.pcap -Y 's7comm.param.func in {0x05 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f 0x28 0x29 0x2b 0x2c}' -T fields -e frame.time -e ip.src -e ip.dst -e s7comm.param.func -e s7comm.header.rosctr

tshark -r /captures/s7_full_20260819_000000.pcap -Y 's7comm.header.rosctr == 3' -T fields -e frame.time -e ip.src -e ip.dst -e s7comm.param.func -e s7comm.header.errclass -e s7comm.header.errcod

```

Carve the block transfer. DownloadBlock/UploadBlock data frames carry OB, FC, FB, DB and SDB bytes; RequestDownload/StartUpload parameters name the target block by type and number. Reassemble by TCP stream and compare against the gold-copy project. A download from anywhere other than the approved engineering workstation is potential logic injection and should be treated as an incident until a change record proves otherwise:

```

tshark -r /captures/s7_full_20260819_000000.pcap -Y 's7comm.param.func in {0x1b 0x1e}' -T fields -e tcp.stream | sort -u

tshark -r /captures/s7_full_20260819_000000.pcap -q -z follow,tcp,raw,0

```

Danfoss-specific write collection. The sabotage was schedule manipulation, not firmware modification. Hunt it as change records, not packets:

· Configuration diffs of defrost and heating schedules, temperature setpoints, and alarm thresholds across the hunt window. A scheduled defrost that becomes continuous, or a setpoint driven to maximum, is the effect signature observed in the campaign.

· Audit trails and change logs for the controller management interface — who changed what, from where, and against which work order.

· Any temperature excursion alarm correlated in time with a configuration change event. That correlation is the operational impact, and it changes both escalation and regulatory reporting obligations.

OT platform collection:

· Claroty xDome — Alerts > Alert Category = "OT Activity Alert" (the category covering controller operations); review the MITRE ATT&CK ICS column for T0843, T0845, T0858, T0813. All Alerts offers no time-frame selector — sort by ALERT UPDATED descending or use the API detected_time filter for a hard window; the category chip counts are lifetime rather than windowed.

· Dragos — Notifications filtered to ATT&CK-ICS Execution and Impair Process Control; every notification ships an event-based PCAP of the triggering conversation, the fastest route to the function code. Open a Case on any confirmed write or program transfer, attach the event PCAP and the Industrial Protocols QFD extract, and follow the attached playbook.

· Nozomi — hard-codes known-bad OT patterns including S7 PDU 0x1A/0x1B download-block operations from unexpected sources, and its process-variable baselining surfaces the downstream effect of a write even where the write was missed:

```

alerts | where mitre_attack ~= "T0843" | sort record_created_at asc | head 500

alerts | where time >= days_ago(90) | where risk > 7 | head 1000

variables | where last_change > days_ago(1) | head 500

```

· Tenable One OT Exposure — the strongest contribution to this hypothesis. Configuration-change and code-snapshot tracking diffs ladder logic, function blocks, tag tables and diagnostic buffers between snapshots, and it catches changes made locally by someone plugged into the front of the controller that never appear on the network at all. Pull snapshot history for every S7 and Danfoss controller and diff against the known-good baseline.

· Forescout eyeInspect — Industrial Threat Library covers S7 control operations; the LAN Communications Profile baseline flags a first-seen conversation pair. Export both and diff across the window.

· Armis — no S7 function-code decode; correlate its ipConnections export against packet findings by source address and timestamp.

Analysis — attribute the implicated source to a host and user, joining from the process side so the subquery stays small:

```

#event_simpleName = ProcessRollup2

| join({

#event_simpleName = NetworkConnectIP4

| RemotePort = 102

field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)

| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

CQL — external-sourced logons, which would place the operator outside the environment entirely:

```

#event_simpleName = UserLogon

| in(LogonType, values=[3, 10])

| RemoteAddressIP4 = *

| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])

| groupBy([ComputerName, UserName, LogonType, RemoteAddressIP4], function=count(as=cnt), limit=max)

| sort(cnt, order=desc, limit=max)

```

OT process correlation — mandatory for every confirmed write. Pull the historian trend and SCADA alarm record for a window bracketing the event. A parameter write followed by a process excursion, or a cold start followed by an alarm flood, converts a network observation into a demonstrated operational impact. For refrigeration, the excursion is the impact — correlate against temperature alarms and defrost state. Where an S7-1500F safety controller is involved, engage process safety engineering immediately rather than completing the technical analysis first.

Threat Actor Profile

Neither source attributes activity to a named group, and this plan does not speculate beyond what they state.

The S7 advisory's assessed intent is persistent reconnaissance in targeted sectors and facilities, conducted to develop capability and prepare to cause operational effects against critical infrastructure. Read access is being used to understand target environments so future write operations can be positioned. That assessment is what drives the hunt's priorities: read-only findings must be escalated with the same seriousness as writes, because the agencies characterize the reads as preparation.

The state-aligned OT-focused actor class fits most closely. Sophistication is high in tradecraft and patience even where individual techniques are simple; dwell is measured in months; the objective is pre-positioning, not immediate disruption. The access path is precisely as described: locate exposed controllers through a scan index, connect where authentication is absent or default, enumerate the CPU and its blocks, read data blocks to understand the process, retain access. Characteristic TTPs: T1596.005, T1694, T0846, T0893, eventually T0821 — and notably T0849 masquerading as monitoring software, which indicates an actor who expects the environment to be monitored and plans to remain.

The AI-assisted capability development materially widens the actor set rather than describing one group. The agencies are explicit that AI dramatically reduces the skill and time required to produce working ICS exploitation scripts and enables rapid adaptation to defensive measures. The practical consequence: the historical protective assumption — that ICS exploitation demands rare, specialized skill and therefore only nation-states could attempt it — no longer holds. Moderate-sophistication criminals, access brokers and hacktivists can generate functional tooling from public documentation, and snap7 gives them a tested foundation.

The refrigeration campaign is the hacktivist-shaped variant in the wild. Exposed controller, default or bypassed auth, fast visible action rather than patient pre-positioning, physical and financial impact designed to be noticed. Where the S7 advisory describes dwelling, the cold-chain incident describes what a low-effort, high-publicity actor does on arrival.

Integrator and vendor-adjacent access is the class hardest to separate from the threat, and the advisory makes the point directly: asset owners working with third-party providers may not realize their systems are exposed. An integrator's engineering workstation presents a programming-device role TSAP, downloads blocks, and does so from an address the asset owner may not recognize — the same observable profile as the threat. The discriminator is never the traffic; it is whether an authorization record exists. An uncorrelated integrator session is a finding, not noise to suppress.

Data Sources Required

Network: full-payload PCAP on every segment carrying TCP 102 and the controller management interfaces — non-negotiable, because S7 function codes cannot be recovered from truncated capture or flow records; NetFlow/IPFIX from OT-facing switches and firewalls for connection-level coverage where full capture is unavailable; firewall permit/deny logs for every path toward port 102 and controller management ports, including the perimeter rules the advisory recommends auditing; SNMP counters and trap-receiver logs from switches facing the controllers; web and reverse-proxy logs for every Danfoss management interface, covering xml.cgi, load_nginx_headers, and SMTP configuration endpoints.

Endpoint: CrowdStrike Falcon from engineering workstations, jump hosts, historians and any Level 3 host with a route to controllers — specifically ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4, NetworkReceiveAcceptIP4, ModuleLoad, the file-write family, DnsRequest, UserLogon, UserLogonFailed2. Windows Security and PowerShell Operational logs with command-line auditing (4688) and script block logging (4104), plus System 7045. Datadog Agent logs from OT Windows/Linux hosts with Live Process Monitoring where licensing and policy permit. Nozomi Arc telemetry on OT-locked workstations where an IT EDR cannot be installed.

OT/ICS: historian trends and SCADA alarm records for the window-required to establish whether any write produced a process effect; controller diagnostic buffers retrieved through engineering software rather than by active query; gold-copy project files, firmware baselines, and known-good configuration snapshots for every S7 and Danfoss controller, without which a snapshot diff has nothing to compare against; exports from every deployed OT platform per the collection notes above.

Vendor, change and access records: the full controller inventory with model and firmware version per device — the advisory makes firmware currency the first mitigation and this hunt requires the inventory as its population definition (anything below Danfoss R4.3.1 is presumptively vulnerable); engineering workstation inventory with TIA Portal/STEP 7 installation status; change management records covering the full window, since almost every discriminator in this plan reduces to whether an authorization record exists; maintenance window schedules; VPN and remote-access logs including integrator and vendor sessions; contractual inventory of which third parties hold remote access to which controllers.

External attack surface: read-only queries against Shodan, Censys and Netlas with keys by environment variable and unavailable engines recorded as coverage gaps; the CISA KEV catalog; and authoritative public IP allocations, ASN registrations, DNS zone data and cloud asset inventory. That last item is load-bearing rather than optional — without an authoritative ownership record an index hit cannot be attributed, and an unattributable hit is inconclusive, not negative. Because integrators frequently host connectivity on their own address space, the inventory must extend to provider-hosted assets.

Detection Signatures

The SIGMA rules span process creation, image load, network connection and file event so that a single logging gap cannot blind the whole set. Each requires an approved-workstation inventory maintained in the filter — the rules are only as good as that list.

```yaml

title: Snap7 Library Loaded Outside Approved Engineering Workstation

id: 3f8a1c74-52e9-4b60-a1d7-9c04e6b28f15

status: experimental

description: Detects the snap7 industrial automation library being loaded by a process, consistent with AI-generated S7 tooling masquerading as monitoring software per joint advisory AA26-231A. Requires an approved-engineering-workstation list in the filter.

references:

- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

author: 1898 & Co. Threat Hunt Team

date: 2026/08/19

tags:

- attack.execution

- attack.t0834

- attack.defense_evasion

- attack.t0849

logsource:

category: image_load

product: windows

detection:

selection:

ImageLoaded|contains:

- 'snap7.dll'

- 'snap7'

filter_approved:

Computer|startswith:

- 'EWS'

condition: selection and not filter_approved

falsepositives:

- Approved OT monitoring or historian products that legitimately bundle snap7

- Integrator-supplied engineering tooling on a documented workstation

level: high

```

```yaml

title: Python or Script Host Connecting to Siemens S7 Controller on TCP 102

id: 6d2b9e05-7a41-48cf-b3e2-1f5807a9dc36

status: experimental

description: Detects a scripting interpreter establishing a connection to TCP port 102 (S7comm/ISO-on-TCP), consistent with AI-generated Python tooling built on snap7 rather than legitimate engineering software.

references:

- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

author: 1898 & Co. Threat Hunt Team

date: 2026/08/19

tags:

- attack.execution

- attack.t0834

- attack.discovery

- attack.t0846

logsource:

category: network_connection

product: windows

detection:

selection:

DestinationPort: 102

Image|endswith:

- '\python.exe'

- '\pythonw.exe'

- '\powershell.exe'

- '\pwsh.exe'

- '\wscript.exe'

- '\cscript.exe'

condition: selection

falsepositives:

- Sanctioned Python-based historian collectors on approved hosts

- Vendor diagnostic tooling during a documented maintenance window

level: high

```

```yaml

title: S7comm Connection From Host Outside Sanctioned Engineering Set

id: 8c5f3d19-4e72-4a08-95b6-d20e1738ba47

status: experimental

description: Detects any connection to TCP port 102 from a host that is not an approved engineering workstation or historian, covering the reconnaissance and insecure-credential access described in AA26-231A.

references:

- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

author: 1898 & Co. Threat Hunt Team

date: 2026/08/19

tags:

- attack.discovery

- attack.t0846

- attack.lateral_movement

- attack.t1694

logsource:

category: network_connection

detection:

selection:

DestinationPort: 102

filter_sanctioned:

SourceIp|cidr:

- '10.30.10.0/28'

condition: selection and not filter_sanctioned

falsepositives:

- Newly commissioned engineering workstations not yet added to the sanctioned range

- IEC 61850 MMS traffic, which shares TCP 102 and must be excluded by protocol-ID byte at sites running both

level: high

yaml

title: Snap7 Library or S7 Tooling Written to Disk

id: 1e7c04a6-9b38-4d52-8fa1-63d905c7e2b8

status: experimental

description: Detects the snap7 library or S7 client tooling written to a workstation, particularly to staging or user-writable paths, consistent with deployment of AI-generated exploitation tooling.

references:

- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

author: 1898 & Co. Threat Hunt Team

date: 2026/08/19

tags:

- attack.execution

- attack.t0834

- attack.resource_development

- attack.t1588.007

logsource:

category: file_event

product: windows

detection:

selection_name:

TargetFilename|contains:

- 'snap7'

- 'python-snap7'

selection_path:

TargetFilename|contains:

- '\Temp\'

- '\Downloads\'

- '\ProgramData\'

- '\Public\'

condition: selection_name and selection_path

falsepositives:

- Legitimate installation of an OT monitoring product bundling snap7 via a temporary staging directory

- Developer/integrator workstations where snap7 is an accepted dependency

level: medium

```

```yaml

title: Danfoss Controller Management Endpoint Accessed Outside Change Window

id: 4a9d2f61-3c85-4e0b-b7a4-95f18e2c6d03

status: experimental

description: Detects HTTP requests to Danfoss AK-SM 800A management endpoints associated with the code-of-the-day authentication bypass (CVE-2025-41450), Nginx headers.conf injection (CVE-2025-41452), and SMTP configuration changes (CVE-2025-41451).

references:

- https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

author: 1898 & Co. Threat Hunt Team

date: 2026/08/19

tags:

- attack.initial_access

- attack.t1190

- attack.execution

- attack.t1059

- attack.impact

logsource:

category: webserver

detection:

selection_cgi:

cs-uri-query|contains:

- 'xml.cgi'

- 'action=getauth'

selection_nginx:

cs-uri-query|contains: 'load_nginx_headers'

selection_smtp:

cs-uri-query|contains: 'smtp'

filter_change_window:

# Suppress documented maintenance windows via lookup

condition: (selection_cgi or selection_nginx or selection_smtp) and not filter_change_window

falsepositives:

- Legitimate administrative sessions during approved change windows

- Automated configuration management where documented and authorized

level: high

Snort/Suricata — local SIDs from 1,000,000. Set OT_NET to the controller range and EWS_NET to the approved workstation range. Validate every content offset against your own captures before enabling in blocking mode — the S7 function byte must fall at the parameter function position, not merely anywhere in the payload, and an unvalidated offset produces both false positives and false negatives:

alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7comm PLCStop job from non-engineering host (T0813 Denial of Control)"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|32 01|"; distance:0; content:"|29|"; classtype:attempted-dos; sid:1000101; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)

alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7comm program download from non-engineering host (T0843 Program Download)"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|32 01|"; distance:0; pcre:"/\x32\x01.{8}[\x1a\x1b\x1c]/s"; classtype:attempted-admin; sid:1000102; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)

alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7comm program upload from non-engineering host (T0845 Program Upload)"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|32 01|"; distance:0; pcre:"/\x32\x01.{8}[\x1d\x1e\x1f]/s"; classtype:attempted-recon; sid:1000103; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)

alert tcp any any -> $OT_NET 102 (msg:"Sequential S7 connection attempts consistent with port 102 scanning"; flow:to_server; flags:S; detection_filter:track by_src, count 10, seconds 60; classtype:attempted-recon; sid:1000104; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)

alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7CommPlus session from non-engineering host - programming-session indicator"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|72|"; distance:5; within:3; threshold:type limit, track by_src, count 1, seconds 600; classtype:attempted-admin; sid:1000105; rev:1;)

alert tcp any any -> $DANFOSS_NET $HTTP_PORTS (msg:"Danfoss AK-SM management request to getauth endpoint (CVE-2025-41450 abuse)"; flow:to_server,established; content:"xml.cgi"; http_uri; content:"getauth"; http_uri; classtype:attempted-admin; sid:1000110; rev:1; reference:url,claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers;)

alert tcp any any -> $DANFOSS_NET $HTTP_PORTS (msg:"Danfoss Nginx headers.conf injection attempt (CVE-2025-41452)"; flow:to_server,established; content:"load_nginx_headers"; http_uri; classtype:attempted-admin; sid:1000111; rev:1; reference:url,claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers;)

YARA — snap7 masquerading tooling. The condition requires a snap7 import together with an S7-specific API call and a controller-addressing artifact, because any one alone matches legitimate automation code. The masquerading branch is separated deliberately: a script importing snap7 that also names itself as monitoring/telemetry software matches the advisory's specific T0849 behavior and warrants a different escalation path from ordinary snap7 usage. The file-size ceiling keeps the rule off large compiled applications that merely bundle the library.

```yara

rule S7_Snap7_Masquerading_Client_Tool

{

meta:

description = "Script or tool built on snap7/python-snap7 that addresses Siemens S7 controllers, including variants masqueraded as OT monitoring software (joint advisory AA26-231A)"

author = "1898 & Co. Threat Hunt Team"

date = "2026-08-19"

reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a"

strings:

$imp1 = "import snap7" ascii nocase

$imp2 = "from snap7" ascii nocase

$imp3 = "snap7.dll" ascii nocase

$imp4 = "libsnap7" ascii nocase

$api1 = "Cli_ConnectTo" ascii

$api2 = "db_read" ascii nocase

$api3 = "db_write" ascii nocase

$api4 = "read_area" ascii nocase

$api5 = "write_area" ascii nocase

$api6 = "plc_stop" ascii nocase

$api7 = "full_upload" ascii nocase

$addr1 = "rack" ascii nocase

$addr2 = "slot" ascii nocase

$addr3 = ":102" ascii

$masq1 = "monitor" ascii nocase

$masq2 = "telemetry" ascii nocase

$masq3 = "collector" ascii nocase

$masq4 = "watchdog" ascii nocase

condition:

filesize < 2MB and

any of ( $imp* ) and

(

( any of ( $api* ) and any of ( $addr* ) )

or ( any of ( $api* ) and any of ( $masq* ) )

)

}

```

YARA - in-memory session artifacts. A script can be run from memory, deleted after execution, or delivered by an interpreter that never wrote it to disk. The condition anchors on snap7 client symbols in the loaded library's export table alongside a live session artifact, requiring two S7 API strings rather than one so mere library presence in a legitimate process's address space does not match. Scanning another process's memory requires SeDebugPrivilege on Windows; Falcon RTR can execute remotely.

```yara

rule S7_Client_Session_Memory_Artifacts

{

meta:

description = "In-memory artifacts of an active snap7-based S7comm client session against a Siemens controller"

author = "1898 & Co. Threat Hunt Team"

date = "2026-08-19"

reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a"

strings:

$sym1 = "Cli_ConnectTo" ascii wide

$sym2 = "Cli_DBRead" ascii wide

$sym3 = "Cli_DBWrite" ascii wide

$sym4 = "Cli_PlcStop" ascii wide

$sym5 = "Cli_FullUpload" ascii wide

$sym6 = "Cli_Download" ascii wide

$sess1 = "ISO-on-TCP" ascii wide nocase

$sess2 = "S7comm" ascii wide nocase

$sess3 = { 03 00 00 16 11 E0 }

$lib = "snap7" ascii wide nocase

condition:

$lib and

2 of ( $sym* ) and

any of ( $sess1, $sess2, $sess3 )

}

```

YARA — credential-dumping memory artifacts. Required because this hunt covers lateral movement (T1694) and the engineering workstations in scope are high-value credential targets whose compromise is the most likely route to a controller that is not directly exposed. Scope note: this rule targets Windows LSASS tooling and will not match Linux credential dumping from /proc (T1003.007) — on Linux engineering hosts, the preceding rules plus endpoint process telemetry carry that coverage.

```yara

rule Credential_Dump_Tool_Memory_Artifacts

{

meta:

description = "In-memory artifacts of common credential-dumping tooling on engineering workstations and jump hosts with a route to S7 controllers"

author = "1898 & Co. Threat Hunt Team"

date = "2026-08-19"

reference = "https://attack.mitre.org/techniques/T1003/001/"

strings:

$mk1 = "sekurlsa::logonpasswords" ascii wide nocase

$mk2 = "lsadump::sam" ascii wide nocase

$mk3 = "privilege::debug" ascii wide nocase

$mk4 = "mimikatz" ascii wide nocase

$mkh = { 6D 69 6D 69 6B 61 74 7A }

$wce1 = "wce.exe" ascii wide nocase

$gs1 = "gsecdump" ascii wide nocase

$cs1 = "MiniDump" ascii wide nocase

$cs2 = "comsvcs" ascii wide nocase

$api1 = "NtReadVirtualMemory" ascii wide

$api2 = "ReadProcessMemory" ascii wide

$lsass = "lsass.exe" ascii wide nocase

condition:

any of ( $mk1, $mk2, $mk3, $mk4, $mkh )

or ( $wce1 and $lsass )

or $gs1

or ( $cs1 and $cs2 and $lsass )

or ( any of ( $api1, $api2 ) and $lsass and any of ( $mk4, $wce1, $gs1, $cs2 ) )

}

```

Indicators of Compromise

Neither source publishes network or file indicators. Every indicator below is behavioral by necessity, and this is a defining property of the hunt rather than a gap in it. A hunt that waits for a signature here will find nothing.

Category Indicator Source Hunt Leg

Exposure Danfoss StoreView management interface reachable from the internet Claroty Team82 / campaign reporting H1

Exposure Siemens S7 TCP 102 service visible in Shodan/Censys/Netlas AA26-231A H1

Exposure Firmware below Danfoss R4.3.1 Claroty / Danfoss H1

Exposure Default or absent authentication on any controller AA26-231A H1, H2

Behavior .cgi requests to getauth with hidden redacted attributes (code-of-the-day path) CVE-2025-41450 H2

Behavior load_nginx_headers invoked outside a change window CVE-2025-41452 H2

Behavior SMTP config update touching the email auth password field CVE-2025-41451 H2

Behavior COTP connection request presenting programming-device source TSAP 0x01 from an unsanctioned host AA26-231A H2

Behavior BlockList 0x2F / GetBlockInfo 0x31 / GetDiagData 0x32 sweep from a non-EWS host AA26-231A H2

Behavior One source reaching >5 distinct controllers on 102 AA26-231A H2

Behavior Host resolving shodan/censys/zoomeye from inside the OT network AA26-231A H2

Tooling snap7.dll, libsnap7, import snap7 on a non-approved host AA26-231A H3

Tooling Python process speaking classic S7comm to a TIA-only S7-1500 AA26-231A H3

Tooling Process named monitor/telemetry/collector/watchdog speaking S7comm with no known product attribution T0849 H3

Impact WriteVar 0x05, download 0x1A–0x1C, upload 0x1D–0x1F, PLCStop 0x29, start 0x2B/0x2C from non-EWS AA26-231A H4

Impact Successful AckData (error class 0x00) paired to a write/download PDU AA26-231A H4

Impact Error class 0x87 (access denied) on control jobs — authentication probing AA26-231A H4

Impact Defrost/heating schedule changed to continuous; setpoints driven to maximum Campaign reporting H4

Impact Temperature excursion alarm correlated with a config change event Campaign reporting H4

Credential LSASS access with memory-read APIs + tool indicator T1003.001 H3/H4 support

Absence is not exoneration. Nozomi Guardian's head returns 10 rows unbounded; xDome under-reports session and byte counts silently; Dragos detections depend on Knowledge Pack currency; Armis and Forescout perform no function-code decode; Datadog and Falcon cannot see S7 payloads at all. Every coverage gap in this plan must be named in the report rather than left to look like a clean negative.

Remediation and Mitigation

Immediate — do these before the hunt finishes:

1. Patch the cold chain. Danfoss addressed the core flaws in firmware R4.3.1 and equivalent patches for related systems. Treat anything below R4.3.1 as actively vulnerable. Confirm AK-SC355-series patch parity with the vendor.

2. Remove controllers from the public internet. Vendors and CERT-FR advise disconnecting management consoles from direct internet access. Place cold-chain and process-control gear behind segmented local management networks with strict VPN or zero-trust access. This single control defeats the entire initial-access path for both campaigns.

3. Sweep for default and unconfigured authentication on every controller, including hidden or vendor-support mechanisms. The code-of-the-day path is a vendor feature; ensure it is not the only thing standing between the internet and an administrative session.

4. Audit perimeter and firewall rules toward TCP 102 and controller management ports, including rules that predate the current architecture and rules owned by integrators.

5. Audit for exposed controllers across the entire inventory, including integrator and MSP-owned address space, and include acquisition and franchise estates — the refrigeration campaign hit "hundreds of European and international retail locations," which is exactly the profile of an estate with delegated IT and no central exposure register.

Structural:

6. A hardware and firmware inventory per site. You cannot patch or segment what you have not enumerated, and the advisory makes firmware currency the first mitigation.

7. An approved engineering workstation register. Every SIGMA rule above depends on it. It is also the only durable discriminator between a legitimate integrator and an actor behaving identically.

8. Maintain gold-copy project files and known-good configuration snapshots for every controller. Without a baseline, a code-snapshot diff has nothing to compare against and the write detection degrades to guesswork.

9. Remove or rotate default SNMP community strings on OT assets, and enforce SNMPv3 authPriv. Treat any device still answering a default community as a finding.

10. Establish a change-record correlation workflow so that every write, download, or schedule change can be matched to an authorization in near-real-time rather than during the next audit.

11. Retain full-payload PCAP on port 102 and controller management interfaces as a standing capability, not a hunt-time scramble. Function codes cannot be recovered after the fact from flow data.

12. Reduce third-party exposure deliberately: inventory integrator access, require MFA on vendor remote paths, and contractually require notification when an integrator exposes a controller on its own address space.

Hunt Execution Order and Deliverables

Execute in this sequence — each step scopes the next:

1. Hypothesis 1 (external exposure, passive indices only). Output: an attributed list of exposed controllers and a named coverage gap for any estate you could not attribute. This result scopes everything else.

2. Hypothesis 2 (internal reconnaissance). Output: the sanctioned port 102 conversation baseline and the deviation list from it. Pivot every H1-confirmed controller into exhaustive review.

3. Hypothesis 3 (snap7 tooling). Output: the approved engineering population plus every host that touches port 102 and is not in it.

4. Hypothesis 4 (writes and impacts). Output: every control job and schedule change paired to an authorization record, with process-effect correlation for each confirmed successful write.

5. Detection tuning — promote validated queries to standing monitors, convert confirmed patterns to Custom IOAs and custom analytics, and publish the exposure finding regardless of whether any intrusion is found.

The expected headline finding is exposure, not intrusion. If Hypothesis 1 returns internet-reachable Danfoss controllers below R4.3.1 or Siemens CPUs on open 102, that is a reportable condition and a presumptive target-selection finding independent of any observed exploitation — precisely because the actors locate targets by reading the same indices, and because continuous exposure means the asset has been on a published target list for the entire window. Read-only S7comm findings must be escalated with the same seriousness as writes: the authoring agencies assess the reads as pre-positioning for effects, and the refrigeration campaign is a demonstration of what those effects look like when the same access path is used against a physical process with no authentication in the way.

References:

1. Claroty Team82, "Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers," August 9, 2026. https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

2. NSA/CISA/FBI/DOE/EPA Joint Advisory AA26-231A, "AI-Assisted S7comm Exploitation and Internet-Exposed Siemens S7 Series PLCs," August 19, 2026.

3. 1898 & Co. Advisory, "Threat Hunt Plan: Siemens S7 Series PLCs," August 19, 2026. https://1898advisories.burnsmcd.com/threat-hunt-plan-siemens-s7-series-plcs-ai-assisted-s7comm-exploitation-snap7-masquerading-tools-and-internet-exposure

4. Campaign reporting on commercial refrigeration sabotage, including European retail impact, controller lockdown into defrost/heating cycles, and the 50°C–80°C temperature excursions.

5. CERT-FR advisory on cold-chain controller exposure and network isolation.

6. CISA Known Exploited Vulnerabilities catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Attack : stolen client secrets to sign into Entra ID as legitimate applications.

2026-11-05T16:05:07.775+11:00

A major threat campaign is actively targeting organizations by using stolen client secrets to sign into Entra ID as legitimate applications.

Because this bypasses user passwords and MFA prompts, typical Conditional Access policies may not stop it. Once inside, threat actors are targeting Azure Resource Manager, Key Vault, Graph API, and SharePoint files to harvest more credentials. If you manage a tenant or an MSP application, check your logs immediately. 🔍 What to check right now: 1. Go to Entra ID > Monitoring & health > Sign-in logs > Service principal sign-ins. 2. Search for these known Indicators of Compromise (IoCs): • 199.19.77.84 (High confidence link) • 199.19.77.18 • 65.87.223.26 3. Look for error codes AADSTS7000215 (invalid secret) and AADSTS7000222 (expired secret) coming from unrecognized IP addresses. 4. Microsoft Defender Users: Search Threat Analytics for "Stolen application credentials" to read the full scope. Review your non-interactive sign-ins and look back as far as your data retention allows.

Tip: block geographic regions your user base is unauthorized to connect from.

In this case, at least for US based businesses you could rule out two of these source IPs without having to check. Another more fine toothed rule would be block tor exit nodes. No legitimate good or legitimate business need for connecting through Tor

Tip2: check AADServicePrincipalSignInLogs for unfamiliar IPs (if you're even shipping that table), list apps where credentials were added recently via the audit log ("Update application – Certificates and secrets management"), and rotate anything that looks off.

The Difference Between Advising and Shaming

2026-07-12T04:23:36.428+10:00

Imam Ibn Rajab Al-Hanbali's work, "The Difference Between Advising and Shaming," is a profound exploration of the subtle but crucial distinctions between offering constructive #advice and engaging in harmful #criticism. His insights are timeless, providing valuable guidance on how to interact with others in a manner that promotes growth and preserves dignity.

Here are ten key lessons from the book that resonate deeply:

1. Intent Matters: The intention behind advising should always be to help and support the individual. In contrast, shaming aims to belittle and demean. The purpose behind the words greatly influences how they are received.

2. Respect and Dignity: Effective advice honors the recipient's dignity and self-worth. Shaming, however, undermines a person's value and can inflict emotional harm.

3. Constructive vs. Destructive: Advising offers constructive feedback that promotes improvement and growth. Shaming is destructive, often leaving the individual feeling worse without offering a clear path forward.

4. Focus on Behavior, Not Person: Good advice targets specific behaviors or actions and suggests ways to improve them. Shaming attacks the person’s character or identity, making it personal and damaging.

5. Empathy and Understanding: Advising should come from a place of empathy and understanding, taking into account the person's circumstances and feelings. Shaming lacks empathy and often disregards the individual's context.

6. Encouragement vs Discouragement: Advising encourages and motivates the person to do better, offering support and upliftment. Shaming discourages, leading to decreased self-esteem and motivation.

7. Long-term Impact: Advising fosters positive long-term effects, building trust and encouraging continuous improvement. Shaming, on the other hand, can have lasting negative impacts, damaging relationships and causing emotional scars.

8. Promotes Growth: Advising is geared towards helping individuals grow and develop, focusing on their potential and strengths. Shaming stunts growth by fixating on faults and weaknesses.

9. Builds Trust: Consistent, respectful advising builds trust and strengthens relationships. Shaming erodes trust, creating distance and resentment.

10. Leads to Positive Change: When done correctly, advising can lead to meaningful and positive change. Shaming often results in defensiveness, denial, or withdrawal, preventing any constructive outcomes.

These lessons emphasize the importance of delivering #feedback with care, empathy, and respect. In doing so, we uplift others and contribute positively to their personal and professional development, rather than tearing them down.

This distinction is particularly relevant in today's world, where the lines between #constructive #criticism and harmful #shaming can easily blur. By applying the principles outlined by Imam Ibn Rajab Al-Hanbali, we can navigate our interactions more mindfully and contribute to a more supportive and understanding society.

The Lazarus Heist

2026-07-12T04:17:36.035+10:00

The 2016 #Bangladesh #Bank #cyber heist, where $81 million was stolen, ranks among the most significant cybercrimes. #Hackers infiltrated Bangladesh Bank’s #SWIFT #network and initiated unauthorized transfers from its account at the #Federal Reserve #Bank of New York. The stolen funds were dispersed through accounts in the #Philippines, where they were laundered via casinos with weak AML (anti-money laundering) regulations.

The #Lazarus Group, a #North #Korean state-sponsored #hacking syndicate, was identified as the primary perpetrator. They used custom #malware to gain access, bypassing inadequate security controls within #Bangladesh #Bank. Investigators, including those from #India, found that the attackers exploited weak network segmentation and #monitoring within the bank. According to Geoff White "The Lazarus Heist"(pp. 109-116), the malware code used was highly advanced, further complicating detection and response.

The incident revealed critical issues in Bangladesh Bank’s #infrastructure, including outdated systems and lack of incident response planning, which delayed containment efforts. Adding to the suspicion, a fire broke out post-incident in a specific #office area, destroying potential evidence and hindering investigations. https://lnkd.in/gNctf6TK

This fire, combined with reports of potential data mishandling by the bank’s IT department, raised doubts about the transparency of the bank’s response.

International organizations, including #INTERPOL and the #FBI, were involved in the probe, linking the heist to #North Korea’s efforts to bypass global sanctions. The heist pressured SWIFT to improve its security standards and forced global financial institutions to reassess their #cybersecurity practices, particularly in high-stakes interbank #communication.

The heist underscores the need for robust #cybersecurity, stronger internal controls, and improved global AML regulations. The case remains a pivotal example of how cybercriminals can #exploit financial systems, emphasizing the need for vigilant, coordinated international cybersecurity efforts.

Cybersecurity from an Islamic Perspective: Bridging Faith and Digital Security

2026-07-12T04:11:07.483+10:00

I'm incredibly excited to announce a significant milestone in my professional journey and passion! After much dedication and hard work, I've officially published my debut book, "Cybersecurity from an Islamic Perspective: Bridging Faith and Digital Security."

This book is a deep dive into how timeless Islamic ethical principles like Sidq (truthfulness/integrity) and Amanah (trustworthiness/custodianship) can offer unique insights and a robust framework for navigating the complex challenges of our digital world. It's a topic I believe is crucial for fostering a more secure and responsible cyberspace for everyone.

As my first book, this project has been a labor of love, drawing inspiration from my background and the esteemed works of many cybersecurity and Islamic scholars. I'm eager to share this unique perspective with my network and the broader community.

You can find "Cybersecurity from an Islamic Perspective" on Amazon here:

👉 https://www.amazon.com.au/dp/B0F9B2LTVT?

For those with Kindle Unlimited, the Kindle version is available to read for free! You can also read a free sample chapter before purchasing.

I would be honored if you would consider reading it. Your insights and feedback are invaluable, especially as I embark on this new chapter as an author. Please feel free to share your thoughts, and let's continue the conversation around ethics and security in the digital age.

#Cybersecurity #IslamicEthics #DigitalSecurity #NewBook #FirstTimeAuthor #Infosec #FaysalHasan #EthicalAI #DigitalResilience #TechEthics #KindleUnlimited #CISSP #Policy #Islam #Frameworks #OT #GRC #Governance

First known ransomware that uses Artificial Intelligence to operate.

2026-07-12T04:05:39.087+10:00

The game has changed. #ESETResearch has uncovered #PromptLock, the first known #ransomware that uses #artificial #intelligence to operate.

This isn't a pre-programmed #attack. Written in #Golang, this novel #malware leverages a local, #open-source #AI model (gpt-oss:20b) and the Ollama API to write its own #malicious Lua scripts on the fly.

They have identified both #Windows and #Linux variants of this #ransomware uploaded to VirusTotal.

This means the #attack #code can change with every #execution, making it incredibly difficult for traditional #security solutions to keep up.

ESET have named this threat Filecoder.PromptLock.A.
IoCs (Indicators of Compromise):
📄 24BF7B7B72F54AA5B93C6681B4F69E579A47D7C102
AD223FE2BB4563446AEE5227357BBFDC8ADA3797
BB8FB75285BCD151132A3287F2786D4D91DA58B8
F3F4C40C344695388E10CBF29DDB18EF3B61F7EF
639DBC9B365096D6347142FCAE64725BD9F73270
161CDCDB46FB8A348AEC609A86FF5823752065D2

This is a wake-up call for the cybersecurity industry.

We need to prepare for a new era of polymorphic, AI-driven threats.

#Ransomware #AI #Cybersecurity #PromptLock #ESETResearch #Threats #Infosec #Golang

Level up your OT skills with these live demos and learning resources.

2026-07-12T04:02:12.485+10:00

Level up your OT skills with these live demos and learning resources.

Whether you're an Cyber pro wants to know more about ICS and OT or IT professional, an engineer, or just starting in ICS/SCADA cybersecurity, these resources are a must-see.

I have got something for everyone, from live automation demos to guides on building your own cyber lab.

Live Automation Demo: Check out the Ecava IGX SCADA IGX Systems live demo. This is a great way to see a full-featured industrial control system in action, complete with real-time data, trends, and alarm management.
https://lnkd.in/g3XvUEmM

Nuclear Reactor Simulator: Test your operational skills with the Dalton Nuclear Reactor Simulator from The University of Manchester Faculty of Science and Engineering TheUniversity of Manchester.

A unique and hands-on tool for understanding the complexities of critical infrastructure.
https://lnkd.in/gC3PZHSP

one more is ITrust from Singapore which is the host of several world-class testbeds and training platforms. For Electric, water and IOT etc can be found here https://lnkd.in/gwajtsNH

Another one is Labshock by Zakhar Bernhardt which provides a ready-to-use environment to learn, simulate and test defensive strategies. https://lnkd.in/gkn_4gKT

and this is on of his great post on OT SIEM Mastery: Your Leveling Guide 1-60
https://lnkd.in/geHfR_vi?

Graphical Realism Framework for Industrial Control Simulation (GRFICS)
https://lnkd.in/gSqyyTk2

Virtual Lab Setup Guide: Ready to get hands-on? Rodrigo Cantera Pérez blog series provides a step-by-step guide to setting up a virtual lab to test SCADA protocols and attack Modbus TCP devices.
https://lnkd.in/geRNu9ZW

For OT compliance IEC62443 Simulator https://lnkd.in/eU-KwFRs

OT substation https://lnkd.in/gAgifT8f

and finally ICS/SCADA Cybersecurity Resources: Getting into OT security? @Robert M. Lee founder and CEO Dragos, Inc., has put together a legendary collection of resources for beginners, covering everything from foundational skills to specific training. this is an old post but a lot still relevent
https://lnkd.in/gcVfVGs4

Save this post , like, or Share your favorite resources in the comments!

#OT #OperationalTechnology #ICS #SCADA #Cybersecurity #Simulator #IEC62443 #IndustrialAutomation #Engineering #ProfessionalDevelopment #Energy #oil #gas #manufacturing #automation #cyberguide #pipeline #industry #Nuclear #rail #transport

Cyber Health Check Tool

2026-07-12T04:00:06.469+10:00

Try the new Cyber Health Check Tool to get a tailored action plan to improve your cyber security.

Whether as an individual, or for your business or not-for-profit, the free and anonymous online tool is a fast self-assessment to measure your cyber awareness.

Once completed, you'll have personalised advice to improve your cyber security. You can also track your progress by implementing your action plan and re-assessing.

Try the tool now: https://lnkd.in/g2EMp6YN

OT Cyber Resilience Summit

2026-07-12T03:56:10.249+10:00

A full day of deep insights at the #OT Cyber Resilience Summit in #Melbourne The energy was palpable, with a powerful gathering of #Australia's top leaders in operational technology security.

The consensus was clear: moving beyond theory to on the ground execution is key. My main takeaways:

🔷 Asset Inventory is Job Zero: But it must be intelligent. Context like system interdependencies and physical location is everything.

🔷 Close the Design Reality Gap: Resilience is built by engaging directly with site operations, not just from design documents.

🔷 Build the Right Structure: Dedicated roles, clear IT/OT frameworks, and hygiene focused KPIs are non negotiable for program maturity.

🔷 Lean on Proven Frameworks: The #SANS 5 Critical Controls and the new #ASD #ACSC "CI Fortify" guide provide an essential blueprint for action.

It was also a pleasure to reconnect with peers and discuss these critical topics.

The need for a principled, holistic approach is what inspired me to write

"The Ethical Guardian of Industry," - which merges advanced security strategies with ethical governance to protect our vital infrastructure available at #Amazon and #Kindle to check out follow this link https://lnkd.in/gxQ3_4Dm

Grateful for the knowledge shared by all and love your feedback on the book!

#OTCyberSecurity #CyberResilience #OperationalTechnology #ICSsecurity #Melbourne #CriticalInfrastructure #ASD #ACSC #SANS #CIFortify #ICS #OT #Scada #Stuxnet #Cyber

Defend your Microsoft Defender now

2026-07-12T03:49:15.784+10:00

Defend your #Microsoft #Defender now

The #Microsoft #Defender Triad Your SOC Can't Afford to Ignore

When a disgruntled researcher (Nightmare-Eclipse/Chaotic Eclipse) drops three coordinated tools on GitHub in 18 days #BlueHammer, #RedSun, and #UnDefend the industry must pay attention.

The Three-Pronged Attack:

🔵 #BlueHammer (CVE-2026-33825, CVSS 7.8) Patched. A local privilege escalation (LPE) flaw chaining TOCTOU and path confusion to extract NTLM hashes and escalate to SYSTEM. Exploited in the wild since April 10.

🔴 #RedSun (Unpatched) A privilege escalation with ≈100% reliability on fully updated Windows 10, 11, and Server 2019+. It abuses Defender’s "cloud tag" file restoration to overwrite a system binary (TieringEngineService.exe) and executes it as SYSTEM.

🔻 #UnDefend (Unpatched) A denial-of-service tool that, from a standard user account, blocks Defender signature updates (passive) or disables the engine entirely (aggressive), leaving systems blind.

What This Means for Business:

Huntress has confirmed all three techniques are already weaponized in the wild. With #RedSun and #UnDefend unpatched, you have no official fix. A single initial access (phishing, stolen creds) can lead to:

· Unprivileged user → Full SYSTEM access
· NTLM hash extraction and lateral movement
· Defender blind spot for follow-on payloads

What This Means for the Attacker:

This isn't just a bug report, it's a complete offensive kill chain. Escalate (BlueHammer/RedSun), execute (SYSTEM payload), and blind detection (UnDefend). No memory corruption, no kernel exploit, just logic flaws in Defender's own trusted operations.

Your Action Plan:

· Hunt for indicators: Unexpected Cloud Files sync registrations, NTFS junction/reparse point creation, VSS snapshot enumeration from user-space processes

· Monitor privileged writes to C:\Windows\System32\TieringEngineService.exe

· Consider disabling Cloud-delivered protection as a temporary mitigation for RedSun

· Assume compromise if unpatched systems have had local code execution exposure

Run defender XDR queries published by Steven Lim https://lnkd.in/gFR5bFRz

💡 Bigger picture: This episode underscores the fragility of supply chain trust and the catastrophic consequences when vulnerability disclosure breaks down. Microsoft credited other researchers for CVE-2026-33825—not Nightmare-Eclipse—fueling an already volatile situation.

Zero-days are inevitable. Having three dropped in rapid succession by the same researcher, with two remaining unpatched, is a wake-up call for proactive threat hunting.

Stay vigilant. 🛡️

#cybersecurity #infosec #Microsoft #ZeroDay #WindowsDefender #PrivilegeEscalation #BlueHammer #RedSun #UnDefend #ThreatIntelligence

Critical EDR threats - RoguePlanet,Silent Choke

2026-07-12T03:46:27.987+10:00

🔻 Three critical #EDR threats dropped in the last couple of weeks that fundamentally break how we think about endpoint security.

If your strategy relies on "having #EDR installed and we are secure," know this below tools ready to break in your defence.

below are quick technical summary of the tools and techniques full details technical link in the comment section.

1. #EDRChoker (Silent Choke)
Throttles EDR outbound bandwidth to 8 bits/sec using Windows QoS.

How: Targets pacer.sys below WFP. TLS handshakes time out.
Result: EDR goes blind. Agent looks online. SOC sees nothing.

2. #AI Evasion Malware Lab Factory The attacker had not written a clever new piece of malware. They had built a factory. Wired into the Cursor AI coding IDE and driven by multiple Anthropic Claude Opus 4.5 agents, the setup mass-produced and tested EDR-evasion payloads.
Claude Opus 4.5 mass-produced 70+ evasion techniques against EDRs, #CrowdStrike, #Defender.

Reality is #AI hallucinated success rates, but productivity multiplier is real. One operator now does what took a team of Hackers.

3. #RoguePlanet -NEW RoguePlanet Windows Defender Vulnerability.
Race condition in #Microsoft #Defender → Local Privilege Escalation to SYSTEM.

Impact: Works on fully patched Windows 10/11 (June 2026). Researcher warns: "More Defender vulns coming."

#SOC Actions to catch this tools
#EDRChoker
· Run Get-NetQosPolicy. Monitor Event IDs 4001, 4002.
· Alert on "Sensor Health Status Change."

#AI Factory:
· Hunt \Users\Documents\test\ or \build\out\ executables.
· Alert on >25 LDAP queries in 10 mins.
· Block api.telegram.org & *.workers.dev from workstations.

#RoguePlanet
· Alert on MsMpEng.exe spawning cmd.exe or powershell.exe with #SYSTEM token.
· Disable VHD/VHDX auto-mounting via GPO.
· Prioritize application allowlisting (blocks the exploit entirely).

💼 For Management

1. Tamper Protection: #Sensor dropout must trigger a paged alert.
2. Don't Trust #Defender Alone: More vulns unreleased. Layer controls.
3. Test Your Config: Haven't tested in 30 days? Assume failure.
4. #AI Multiplier is Here: Move from signatures to fundamentals: MFA, patching, allowlisting, segmentation.

Bottom Line is attackers now build factories to bypass your stack, choke telemetry, and weaponize Defender against you. Defend accordingly.

#cybersecurity #EDR #infosec #AI #ThreatHunting #BlueTeam #CISO #MicrosoftDefender #ZeroDay

A large-scale exploitation campaign targeting web content management systems (CMS

2026-07-12T03:39:05.401+10:00

A large-scale exploitation campaign targeting web content management systems (CMS), with many Australian businesses impacted.

The vulnerabilities being targeted affect CMS software and plugins which, if exploited, enable malicious actors to remotely access and control targeted web servers.

Organisations, including small businesses, are encouraged to take immediate action to protect their web servers.

▶ Inspect your CMS for webshells.

▶ Examine your web access logs for any IP addresses making GET or POST requests to any webshell paths.

▶ Treat servers with identified webshells as compromised, isolate them and perform an audit for malicious activity.

▶ Review network logs for interactions with identified IP addresses.

▶ Investigate logging and hosts for evidence of persistence, lateral movement or other malicious actions.

▶ Patch vulnerable systems to prevent re-infection.

▶ If there are indications that websites are compromised, restore websites from a recent known-good backup.

If a service provider maintains your website, point them to this alert and review our guidance at the below link for additional questions to ask.

Read the full alert and take additional steps to protect your websites

👉 https://lnkd.in/gkyDM4uY

Increased risk of phishing scams following CrowdStrike outage

2024-07-21T03:32:00.004+10:00

The Australian Signals Directorate has issued a warning about an increased risk of phishing scams following yesterday's CrowdStrike outage.

According to the alert, ASD’s ACSC has identified numerous malicious websites and unofficial code claiming to assist entities in recovering from the widespread outages caused by the CrowdStrike technical incident.

ASD’s ACSC strongly advises all consumers to obtain their technical information and updates directly from official CrowdStrike sources only. [Learn more here]https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/widespread-outages-relating-crowdstrike-software-update?fbclid=IwZXh0bgNhZW0CMTEAAR1veIrKLYJrloZIx7AvqS6Nlqv3UfvENiPg6lVbHUhffjbS_7HBzNQEGdI_aem_TUaGcC36MEN9SJxw0OUTnQ

It appears that threat actors are exploiting the #CrowdStrike situation through #phishing and #spoofing campaigns.

Here is a list of newly created domains https://urlscan.io/search/#crowdstrike*

Before clicking on any links, use tools like Domain Dossier, URLscan.io, and VirusTotal to check their authenticity — because threat actors never miss an opportunity to exploit a disaster.

#threatactors #hackers #CrowdStrike #phishing #urlscan #cybertip #VirusTotal #ASD #ACSC #AISA #Australia

Crowdstrike Global IT outage affecting computers around the world

2024-07-20T06:40:00.006+10:00

A current worldwide #CrowdStrike issue causing #BSOD. Seen reports from AU, NZ ,Japan, India. And Europe. The global computer outage affecting airports, banks and other businesses.

CrowdStrike’s cybersecurity software — used by numerous Fortune 500 companies, including major global banks, healthcare and energy companies — detects and blocks hacking threats. Like other cybersecurity products, the software requires deep-level access to a computer’s operating system to scan for those threats. In this case, computers running Microsoft Windows appear to be crashing because of the faulty way a software code update issued by CrowdStrike is interacting with the Windows system.

This issue is not impacting Mac- or Linux-based hosts

Some servers on perm and cloud and devices are not resuming correctly and are getting stuck in boot loops that have #Crowdstrike.

Some seen successful reboots which work for about 15 mins and then they stop and then go back into a boot loop.

Technical Breakdown

1. Crowdstrike publishes a content update for their threat feed, which is basically a list of patterns of “bad things”

2. Software agents get this update and apply the controls to block things that match this pattern

3. The update has a pattern which matches a critical Windows process but the software blocks it anyway

4. Windows crashes with a Blue Screen of Death (BSOD) and reboots

5. On reboot, CrowdStrike kills the process again and Windows reboots

6. And it’s now a loop… There are various ways of fixing this but for most systems it will involve physically visiting every affected system, booting into “safe mode” and fixing the problem manually.

For some cloud systems though, such as AWS, “safe mode” is not even possible so this fix doesn’t work. The virtual servers will need to be shut down, their disks cloned, attached to another server, edited to remove the offending files and then finally reattach to the original server.

BUT, if you’re protecting your data and using encryption at rest, you need to manually decrypt the disk with a BitLocker Recovery Key, which is probably - for most companies

Updated workaround steps:

Boot Windows into Safe Mode or the Windows Recovery Environment

Navigate to the C:\Windows\System32\drivers\CrowdStrike directory

Locate the file matching “C-00000291*.sys”, and delete it.

Boot the host normally.

Crowdstrike published a post with updated details for quering machine and how to fix here

https://www.crowdstrike.com/blog/statement-on-falcon-content-update-for-windows-hosts/

This is really just a good reminder of how MANY systems are dependent on IT.

Technology is engrained in every part of our lives. We don’t notice it when it’s working well. We only notice when something goes wrong. No one talks about how many millions of attacks were stopped, or upgrades that went smoothly. Everyone remembers the ones that didn't.

#Crowdstrike #update #BSOD #EDR #outage #ITissue

Free cyber security course. Delve into essential cybersecurity NIST Risk management frameworks

2024-04-15T22:58:00.002+10:00

🌟 Exciting Announcement Alert! Last week, NIST took a significant step in advancing cybersecurity education by releasing four introductory courses covering their flagship publications for FREE! 🆓

📘 Delve into essential cybersecurity frameworks with courses on:

- NIST SP 800-37, Risk Management Framework (RMF)

- NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

- NIST SP 800-53A, Assessing Security and Privacy Controls in Information Systems and Organizations

- NIST SP 800-53B, Control Baselines for Information Systems and Organizations

🔍 These meticulously curated courses offer unparalleled insights into cybersecurity best practices, delivered in a concise format designed to optimize learning efficiency. With just 60 minutes required for each course, professionals can easily incorporate this valuable knowledge into their busy schedules.

But the excitement doesn't stop there! NIST has also unveiled a comprehensive crosswalk between NIST CSF 2.0 and NIST SP 800-53, providing invaluable guidance for cybersecurity practitioners navigating these frameworks.

Some common question and answer regarding the course

Q: Are these courses self-guided or instructor-led?

A: The courses provided are self-guided online courses.

Q: Is there a fee to access these courses?

A: No. The NIST materials provided on the CSRC website, including the RMF and SP 800-53 series introductory courses, are free to any interested party.

Q: Is registration required?

A: No. Registration is not required to access the courses.

Q: Is there a quiz at the end of each course?

A: No, there are no quizzes at the end of each course. The material in each course is provided for informational purposes only.

Q: Are certificates issued upon completion of the courses?

A: At the end of each course presented on this NIST website, a certificate of course completion is provided as a courtesy. The certificate only identifies that the course material was viewed and does not attest to any qualifications, knowledge, or skill level resulting from the completion of the course.

Q: How do I print the certificate of completion?

A: Use the browser's print option, generally found in the browser menu, to print or capture a PDF of the course certificate. Please add your name and the date of completion to the certificate.

🔗 Dive into these invaluable resources today! Links to the crosswalk and courses can be found in here https://csrc.nist.gov/Projects/risk-management/rmf-courses

.Let's elevate our cybersecurity expertise together!

💼 #NIST #Cybersecurity #ProfessionalDevelopment #KnowledgeIsPower

Securing Your Future: The Bright Outlook for Careers in Cybersecurity

2024-03-31T18:14:00.006+11:00

The Bright Future of Careers in Cybersecurity. Explore the thriving job market, competitive salaries, and abundant growth opportunities in cybersecurity careers. Discover why a career in cybersecurity offers both financial rewards and the satisfaction of protecting our digital world

The landscape of cybersecurity careers is experiencing a significant uptrend, fueled by several driving forces:

Rising Cyber Threats:

The frequency, complexity, and cost of cyberattacks are on the rise. This escalating threat landscape is prompting organizations across all sectors to prioritize investments in robust cybersecurity measures.

Advancing Technologies:

The widespread adoption of cloud computing, mobile devices, and the Internet of Things (IoT) is expanding the attack surface for cyber threats. As a result, there is a growing need for skilled professionals to secure these evolving technologies.

Increased Awareness:

With cyberattacks making headlines, both businesses and individuals are increasingly recognizing the critical importance of cybersecurity. This heightened awareness is translating into a greater demand for qualified cybersecurity professionals across industries.

Here are four promising trends to consider when contemplating a career in cybersecurity:

1. Favorable Job Market:

According to recent projections from reputable sources, the global cybersecurity workforce is projected to face a shortage of millions of professionals by 2024. This significant talent gap indicates a thriving job market for individuals with the requisite skills and expertise.

2. Competitive Compensation:

Given the high demand for cybersecurity skills, professionals in this field can anticipate competitive salaries. Many positions offer lucrative earning potential, reflecting the value placed on cybersecurity expertise by organizations worldwide.

3. Abundant Growth Opportunities:

The cybersecurity landscape is dynamic and ever-evolving, presenting numerous avenues for career advancement and skill development. Professionals can specialize in various domains, pursue leadership roles, or explore adjacent fields such as cybercrime investigation.

4. Fulfilling Career Trajectory:

Beyond financial incentives, a career in cybersecurity offers the gratification of safeguarding sensitive information and critical infrastructure. It is a profession where individuals can actively contribute to protecting the digital realm and making a tangible difference in securing our interconnected world.

In conclusion, the outlook for cybersecurity careers is exceptionally promising, with abundant opportunities for growth, competitive compensation, and the chance to make a meaningful impact. For those considering a career in cybersecurity, the future is indeed bright and brimming with potential.

Navigating the Path to a Cybersecurity Career in Australia or anywhere : Roles, Opportunities, and Guidance

2024-03-31T18:02:00.008+11:00

Embarking on a career in cybersecurity is an exciting journey filled with opportunities for growth and learning. With the ever-evolving digital landscape, the demand for skilled cybersecurity professionals continues to rise, making it an ideal time to explore this dynamic field.

In this post, we will delve into the various roles available in cybersecurity, including specialized positions, and provide guidance on how to pursue them effectively in the Australian market

1. Blue Team Roles

Security Analyst: Responsible for monitoring and analyzing security events, investigating incidents, and implementing defensive measures to protect an organization's systems and data.

Security Operations Center (SOC) Analyst: Works in a SOC environment, monitoring security alerts, triaging incidents, and responding to threats in real-time.

Incident Responder: Focuses on incident detection, containment, and recovery, coordinating response efforts during security breaches or incidents.

Getting Started: Entry-level positions often require foundational knowledge of cybersecurity principles and tools. Pursue certifications like CompTIA Security+ and gain experience through internships, entry-level roles, or hands-on projects.

2. Red Team Roles:

Penetration Tester (Pen Tester): Conducts authorized simulated attacks on systems and networks to identify vulnerabilities and assess security posture.

Ethical Hacker: Utilizes hacking techniques and methodologies to identify and address security weaknesses in systems and applications.

Security Consultant: Provides expertise in assessing and improving security controls, conducting security assessments, and recommending remediation measures.

Getting Started: Develop technical skills in penetration testing, network security, and ethical hacking through hands-on labs, capture-the-flag (CTF) competitions, and certifications like Certified Ethical Hacker (CEH) or Offensive Security Certified Professional (OSCP).

3. Compliance and Governance Roles:

Governance, Risk, and Compliance (GRC) Analyst: Ensures adherence to regulatory requirements, industry standards, and internal policies, conducting risk assessments and developing compliance strategies.

Security Auditor: Conducts audits of systems, processes, and controls to assess compliance with regulatory frameworks and industry standards.

Getting Started: Gain knowledge of relevant regulations and standards such as GDPR, HIPAA, ISO 27001, and NIST Cybersecurity Framework. Pursue certifications like Certified Information Systems Auditor (CISA) or Certified Information Security Manager (CISM).

4. Specialized Roles:

Cloud Security Specialist: Focuses on securing cloud environments, ensuring the confidentiality, integrity, and availability of cloud-based assets and services.

IoT Security Specialist: Addresses security challenges associated with Internet of Things (IoT) devices, networks, and ecosystems, ensuring the protection of connected devices and data.

Industrial Control Systems (ICS) Security Analyst: Secures operational technology (OT) environments, including supervisory control and data acquisition (SCADA) systems and industrial control systems, against cyber threats.

Getting Started: Gain specialized knowledge and skills through training programs, certifications, and hands-on experience in specific domains such as cloud security, IoT security, or industrial cybersecurity.

To pursue these roles, it's essential to continuously expand your knowledge, develop practical skills, and stay updated on emerging technologies and threats. Engage in professional development activities, participate in relevant communities and forums, and leverage networking opportunities to connect with industry professionals and explore career paths in cybersecurity. Additionally, consider pursuing advanced certifications and higher education programs to deepen your expertise and advance your career in the field

Getting Started in Cybersecurity: Your Roadmap to Success

Embarking on a career in cybersecurity can seem daunting, especially for newcomers to the field. However, with the right approach and resources, anyone can start their journey towards becoming a skilled cybersecurity professional.

Here's a comprehensive roadmap to help you get started:

1. Gain Foundational Knowledge: Begin by building a strong foundation in cybersecurity principles, concepts, and technologies. Consider enrolling in formal education programs such as cybersecurity-related courses, diplomas, or degree programs offered by universities or technical colleges. These programs cover essential topics such as network security, cryptography, risk management, and ethical hacking, providing you with a solid understanding of the fundamentals.

2. Explore Different Areas of Cybersecurity: Cybersecurity is a broad field with various specializations and career paths. Take the time to explore different areas of cybersecurity to discover where your interests and strengths lie.

The spectrum of skills required in Cyber is larger than that of most professions.

We need people who understand:

➡️ People Management

➡️ Security Compliance and Regulations

➡️ Governance and Risk Management

➡️ Legal and Ethical Considerations

➡️ Security Awareness, Training and Psychology

➡️ Engineering

➡️ Architecture

➡️ Endpoints & Networks

➡️ Secure DevOps (DevSecOps)

➡️ Threat Intelligence

➡️ Detection & Investigation

➡️ Incident Response

➡️ Security Research and Innovation

➡️ and more…

Truth is, effective Cyber Security is a team sport. One where a diverse group of people are working together, communicating and playing to our strengths.

Research roles such as security analyst, penetration tester, security consultant, or compliance officer to understand their responsibilities, required skills, and career prospects. Engage with online communities, forums, and professional networking platforms to connect with experienced professionals and learn from their experiences.

3. Pursue Certifications and Training: Certifications play a crucial role in validating your knowledge and skills in cybersecurity and are highly valued by employers. Consider obtaining industry-recognized certifications such as CompTIA Security+, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or Certified Information Security Manager (CISM). These certifications demonstrate your expertise and commitment to the field, increasing your chances of landing a job in cybersecurity. Additionally, leverage online training platforms and resources such as Cybrary, Coursera, or Udemy to further enhance your skills and knowledge in specific areas of cybersecurity.

4. Gain Practical Experience: Hands-on experience is invaluable in cybersecurity and can significantly enhance your employability. Look for opportunities to gain practical experience through internships, co-op programs, or entry-level positions in cybersecurity-related roles. Many organizations offer internship programs specifically for cybersecurity students or recent graduates, providing valuable exposure to real-world cybersecurity challenges and environments. Additionally, consider participating in capture-the-flag (CTF) competitions, hackathons, or open-source projects to hone your technical skills and problem-solving abilities.

5. Network and Engage with the Cybersecurity Community: Networking is key to success in cybersecurity. Connect with professionals in the field, join online communities and forums, and attend industry events, conferences, and meetups to expand your network and learn from others.

Join professional organizations like the Australian Information Security Association (AISA) or the Australian Computer Society (ACS) to connect with industry professionals and stay updated on the latest trends and developments. Attend events such as BSides, which offer networking opportunities and valuable insights into the cybersecurity community.

Engage with cybersecurity professionals on platforms like LinkedIn, Twitter, or Reddit, participate in discussions, ask questions, and seek mentorship opportunities. Building relationships with experienced professionals can provide valuable insights, guidance, and career opportunities in cybersecurity.

6. Continuously Learn and Stay Updated: Cybersecurity is a constantly evolving field, with new threats, technologies, and best practices emerging regularly. Stay updated on the latest trends, developments, and news in cybersecurity by following industry blogs, podcasts, and news sources. Subscribe to cybersecurity newsletters, join relevant online forums and communities, and participate in webinars, workshops, and training sessions to stay informed and expand your knowledge. Additionally, consider pursuing advanced certifications, attending conferences, or pursuing higher education programs to further develop your expertise and advance your career in cybersecurity.

By following this roadmap and taking proactive steps to build your skills, gain experience, and network with professionals in the field, you can kickstart your career in cybersecurity and embark on a rewarding and fulfilling journey in this dynamic and high-demand field.

Navigating a cybersecurity career in Australia requires dedication, continuous learning, and perseverance. By exploring different roles, gaining practical experience, and staying updated on industry trends, you can embark on a rewarding career path in cybersecurity and contribute to the protection of organizations against evolving digital threats.

For more guidance and resources on pursuing a cybersecurity career in Australia, stay connected with MaximisIT.net, your trusted partner in cybersecurity.

MGM Cyber Attack cost 110 Million

2023-10-08T14:32:00.002+11:00

In September the hospitality and entertainment company #MGM Resorts was hit by a #ransomware attack that shut down its systems at MGM Hotels and Casinos.

The incident affected #hotel reservation systems in the United States and other IT systems that run the casino floors.

The company now revealed that the costs from the #ransomware attack have exceeded $110 million. The company paid third-party experts $10 million to clean up its systems.

Allegedly, a criminal gang made up of U.S. and U.K.-based individuals that cybersecurity experts call #Scattered Spider (aka Roasted 0ktapus, UNC3944 or Storm-0875) initiated a social engineering attack that led to the near shutdown of #MGM Resorts International.

Scattered Spider #encrypted several hundred of their #ESXi servers, which hosted thousands of VMs supporting hundreds of systems widely used in the hospitality industry. This caused cascading chaos. As the #ESXi hosts became encrypted one after another, the applications running on them crashed … one after another … after another. Hotel room keys no longer worked. Dinner reservation systems were down. Point-of-sale systems were unable to take payments. Guests were unable to check in or out. Slot machines were completely unavailable. At this point, MGM was hemorrhaging money – and potentially its credibility.

A nice deep technical Analysis by cyber #security company #CyberArk whic details the #attack based on the information currently available, analyze its root causes and discuss key takeaways to help organizations strengthen their security posture.

#cyber #databreach #socialengineering #ransomware #okta #security

https://www.cyberark.com/resources/blog/the-mgm-resorts-attack-initial-anaysis

Developing and implementing security controls for Azure Active Directory (Azure AD)

2023-06-04T14:00:00.010+10:00

Today we will share the list of things you need to consider for Developing and implementing security controls for Azure Active Directory (Azure AD):

1. Identify Azure AD Assets:

- Create an inventory of all Azure AD assets, including user accounts, groups, applications, service principals, and Azure AD resources.

- Document the purpose and sensitivity level of each asset.

- Classify assets based on their importance and criticality to the organization, considering factors such as the data they provide access to or the applications they authenticate.

2. Perform a Risk Assessment:

- Identify potential threats to your Azure AD environment, such as unauthorized access, identity theft, insider threats, or data breaches.

- Assess vulnerabilities that could be exploited by conducting a comprehensive assessment of your Azure AD configuration and associated resources.

- Evaluate the potential impact of each threat and vulnerability on the confidentiality, integrity, and availability of your Azure AD assets.

- Determine the likelihood of each risk occurring based on historical data, industry trends, and the organization's threat landscape.

- Prioritize risks based on their potential impact and likelihood, focusing on those with the highest potential risk to your Azure AD environment.

3. Define Security Objectives:

- Review your organization's overall security strategy and compliance requirements, including any specific Azure AD security requirements.

- Identify specific security objectives that align with these requirements and the risk assessment findings. Ensure these objectives are measurable and relevant to your organization's needs.

- Examples of security objectives for Azure AD may include enforcing strong authentication policies, implementing conditional access controls, and protecting privileged accounts.

4. Select Security Controls:

- Research and review Azure AD security best practices, Azure Security Center recommendations, and Azure AD-specific security frameworks.

- Identify security controls available in Azure AD that address the identified risks and align with your security objectives.

- Examples of security controls for Azure AD include enabling multi-factor authentication (MFA), implementing conditional access policies, using Azure AD Privileged Identity Management (PIM), and leveraging Azure AD Identity Protection.

- Consider using Azure AD security features such as Azure AD Conditional Access, Azure AD Identity Governance, and Azure AD Privileged Identity Management to enhance your security posture.

5. Design Azure AD Security Architecture:

- Plan the structure of your Azure AD tenant, considering factors such as the number of Azure AD directories, users, groups, and applications required.

- Define the authentication and access models to be used, such as cloud-only identities, hybrid identities with Azure AD Connect, or federation with external identity providers.

- Determine the appropriate Azure AD license level and edition based on your organization's needs for advanced security features.

- Design RBAC roles and assignments for Azure AD resources, ensuring least privilege principles are followed.

- Establish Azure AD security policies, including password policies, sign-in risk policies, and device compliance policies.

6. Implement Security Controls:

- Enable multi-factor authentication (MFA) for Azure AD accounts, especially for privileged accounts and accounts with access to sensitive resources.

- Implement conditional access policies to enforce granular access controls based on user, device, location, and risk factors.

- Utilize Azure AD Identity Protection to detect and respond to suspicious sign-in activities and risky user behaviors.

- Leverage Azure AD Privileged Identity Management (PIM) to manage and monitor privileged access to Azure AD and other Azure resources.

- Regularly review and remediate risky sign-in events, risky users, and vulnerable configurations identified by Azure AD security features.

7. Provide User Training and Awareness:

- Develop training materials and conduct sessions to educate users about Azure AD security best practices.

- Train users on the importance of strong passwords, avoiding password reuse, and using MFA for enhanced security.

- Educate users about recognizing and reporting phishing attempts, suspicious sign-in activities, and other potential security risks.

- Raise awareness about the importance of safeguarding Azure AD credentials, avoiding sharing of accounts, and promptly reporting any unusual activities or potential security breaches.

8. Establish Incident Response Procedures:

- Develop an incident response plan specifically for Azure AD security incidents.

- Define roles and responsibilities for incident response team members, including those responsible for handling Azure AD security incidents.

- Establish communication protocols and reporting mechanisms to ensure prompt detection, response, and resolution of Azure AD security incidents.

- Document step-by-step procedures for isolating affected accounts, investigating potential breaches, resetting compromised credentials, and implementing necessary security measures to prevent future incidents.

- Conduct regular drills and exercises to test the effectiveness of the incident response procedures and identify areas for improvement.

9. Implement Monitoring and Auditing:

- Enable Azure AD auditing to track and monitor activities such as user sign-ins, application registrations, role assignments, and directory changes.

- Utilize Azure AD logs and Azure Monitor to collect and analyze security-related events and alerts.

- Configure alerts and notifications for suspicious activities, such as multiple failed sign-in attempts or privilege escalations.

- Integrate Azure AD with a Security Information and Event Management (SIEM) system for centralized log management, analysis, and correlation.

- Regularly review and analyze Azure AD logs and security reports to identify anomalies, detect security incidents, and take appropriate actions to mitigate risks.

10. Regular Assessment and Improvement:

- Continuously assess the effectiveness of your Azure AD security controls.

- Stay informed about Azure AD security updates, new security features, and best practices provided by Microsoft.

- Conduct periodic security assessments and penetration testing to identify vulnerabilities and weaknesses in your Azure AD environment.

- Monitor Azure Security Center recommendations and implement necessary security improvements.

- Regularly review and update your Azure AD security controls, policies, and procedures to adapt to emerging threats, industry standards, and regulatory requirements.

Certainly! Here's an expanded and elaborated checklist for developing and implementing security controls in Azure AD and AWS:

Checklist for Azure AD Security:

------------------------------------

| Step | Status

1 Identify Azure AD Assets

- List all Azure AD resources and services being used, such as users, groups, applications, and roles.

2 Perform a Risk Assessment

- Identify potential threats and vulnerabilities specific to Azure AD.

- Assess the impact and likelihood of each risk.

3 Define Security Objectives

- Clearly define and document the desired security objectives for Azure AD.

- Ensure objectives align with organizational requirements and compliance standards.

4 Select Security Controls

- Research and identify Azure AD-specific security controls provided by Microsoft.

- Choose controls that address identified risks and align with security objectives.

5 Design Azure AD Security Architecture

- Plan the structure of Azure AD, including directory structure and role assignments.

- Define secure connectivity options and network configurations.

- Establish data encryption strategies for Azure AD.

6 Implement Security Controls

- Enable multi-factor authentication (MFA) for Azure AD users.

- Configure strong password policies and password rotation requirements.

- Implement Azure AD Privileged Identity Management (PIM) for access management.

- Enable auditing and logging for Azure AD activities.

7 Provide User Training and Awareness

- Educate users about Azure AD security best practices and potential threats.

- Train users on recognizing and reporting security incidents or suspicious activities.

7 Establish Incident Response Procedures

- Develop an incident response plan specific to Azure AD security incidents.

- Define roles and responsibilities for incident response team members.

- Establish communication protocols and reporting mechanisms for incidents.

9 Implement Monitoring and Auditing

- Enable Azure AD auditing and configure logs for monitoring and analysis.

- Set up alerts and notifications for suspicious activities or policy violations.

- Integrate Azure AD logs with a centralized logging and monitoring system.

10 Regular Assessment and Improvement

- Conduct regular security assessments and vulnerability scans for Azure AD.

- Stay informed about Azure AD security updates and best practices.

- Continuously review and update Azure AD security controls and policies.

Remember that security is an ongoing process, and it's important to regularly evaluate and improve the security posture of your Azure AD environment to stay ahead of potential threats and ensure the protection of your organization's identity and access management infrastructure.

Finally here is an excellent blogpost by Mandiant for cloud platform compromise with multiple components that would require investigation

https://www.mandiant.com/resources/blog/cloud-bad-log-configurations

Explore Microsoft Bing Chat

2023-05-31T00:05:00.005+10:00

Explore Microsoft Bing Chat is a new feature that allows business users to interact with Microsoft Bing in a conversational way. You can ask Microsoft Bing questions, get insights, create content, and more in natural language. Microsoft Bing responds with informative, intuitive, logical, and actionable responses to help you get things done faster and easier. In this blog post, we'll show you how to use Discover chat on Microsoft Bing and how it can benefit your work.

Here are some steps to get started:

Go to https://www.bing.com and click the chat icon in the lower right corner of the screen.
Select your preferred language and mode from the options.You can switch between Balanced, Creative, and Precision modes according to your needs and preferences.
Type or speak your request or message to Microsoft Bing.
You can use voice input by clicking the microphone icon next to the text box.
Microsoft Bing will respond with relevant and engaging feedback, which can include web results, images, tables, lists, code blocks, LaTex expressions, and more. You can also see suggestions for the next user at the bottom of the chat box.
You can continue the conversation by following the suggestions or by typing or speaking your own request or message. You can also click on the link or reference in the Microsoft Bing response to explore more information.

Chat on Microsoft Bing is a feature that allows you to interact with Bing in a conversational way. You can ask questions, get information, and even generate content using natural language. Chat on Microsoft Bing has three main components:

- Chat: This is where you can type your messages and see Bing's responses. You can also switch between different modes, such as Balanced, Creative, and Precise, to get different types of responses from Bing.

- Compose: This is where you can use Bing's creativity and intelligence to help you write or improve your own content. You can ask Bing to generate poems, stories, code, summaries, lyrics, and more. You can also ask Bing to rewrite, optimize, or enhance your content.

- Insights: This is where you can see additional information and details related to your chat messages. You can see web search results, question answering results, advertisements, and suggestions for the next user turn.

Microsoft Bing chat discovery is designed to help you find answers, create content, and complete tasks naturally and intuitively. Whether you need to research a topic, write a report, create a presentation, or just have fun, you can use the Explore chat on Microsoft Bing to boost your productivity and creativity. Try it today and let us know what you think.

Recommendations for Mitigating BianLian Ransomware Group attack

2023-05-17T18:38:00.001+10:00

To enhance your organization's cybersecurity posture and counter the activities of the BianLian Ransomware Group, we advise implementing the following mitigations. These measures align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and NIST (the National Institute of Standards and Technology). The CPGs outline a minimum set of practices and protections recommended for all organizations, based on existing cybersecurity frameworks and guidance that target common and impactful threats and tactics.

1. Reduce the risk of malicious actors using remote access tools by taking the following actions:

- Conduct an audit of remote access tools on your network to identify authorized and currently used software.

- Review logs to detect abnormal use of portable executable programs running remote access software.

- Utilize security software capable of detecting instances where remote access software is loaded only in memory.

- Allow authorized remote access solutions strictly from within your network, using approved methods like virtual private networks (VPNs) or virtual desktop interfaces (VDIs).

- Block inbound and outbound connections on common remote access software ports and protocols at the network perimeter.

- Implement application controls to manage and control the execution of software, including allowing only approved remote access programs.

- Employ application allowlisting to prevent the installation and execution of unauthorized remote access software, including portable versions that evade traditional antivirus solutions.

For additional guidance, refer to the NSA Cybersecurity Information Sheet on enforcing signed software execution policies.

2. Strictly limit the use of Remote Desktop Protocol (RDP) and other remote desktop services. If RDP is necessary, adhere to best practices such as:

- Conduct network audits to identify systems using RDP.

- Close unused RDP ports.

- Enforce account lockouts after a specified number of failed login attempts.

- Implement phishing-resistant multifactor authentication (MFA).

- Log RDP login attempts.

- Disable command-line and scripting activities and permissions.

- Restrict the use of PowerShell to specific users who manage the network or Windows operating systems.

- Keep PowerShell updated to the latest version and uninstall older versions.

- Enable enhanced PowerShell logging to capture valuable data for monitoring and incident response.

3. Review domain controllers, servers, workstations, and active directories to identify any new or unrecognized accounts. Audit user accounts with administrative privileges and configure access controls based on the principle of least privilege.

4. Reduce the risk of credential compromise by implementing the following measures:

- Place domain admin accounts in the protected users' group to prevent local caching of password hashes.

- Implement Credential Guard for Windows 10 and Server 2016, or enable Protected Process Light for Local Security Authority (LSA) on Windows Server 2012R2.

- Avoid storing plaintext credentials in scripts.

- Implement time-based access for admin-level accounts using methods like Just-in-Time (JIT) access provisioning.

In addition to the above recommendations, the FBI, CISA, and ACSC suggest the following mitigations to limit the adversarial use of system and network discovery techniques and reduce the impact and risk of ransomware or data extortion:

1. Develop and maintain a recovery plan that includes multiple copies of sensitive data and servers stored in physically separate, segmented, and secure locations. Maintain offline backups of data, following the 3-2-1 backup strategy (three copies, two media types, one off-site).

2. Ensure that all accounts with password logins comply with NIST standards for password policies. Use longer passwords, store passwords in hashed format using recognized password managers, add password user "salts" to shared login credentials, avoid password reuse, implement multiple failed login attempt account lockouts, disable password hints, and limit

Are you ready to break into the exciting and dynamic world of cybersecurity?

2023-05-14T01:47:00.002+10:00

Are you ready to break into the exciting and dynamic world of cybersecurity? It's not just a job, it's a lifestyle that attracts a passionate and innovative community of professionals. If you're eager to join their ranks, follow these 10 steps to cheat your way to success!

1.Build a Strong Foundation - turbocharge your career with a comprehensive education in cybersecurity, available through a variety of programs like bootcamps, online courses, degrees, or certifications.

2. Master Technical Skills - impress potential employers by developing a wide range of technical proficiencies, including hardware, software, Windows/Linux, networking, vulnerability scanners, packet sniffers, Nmap, and other cutting-edge professional tools.

3.Network Like a Pro - build relationships with cybersecurity experts by joining local or online groups, meeting like-minded individuals, finding mentors, and learning from the best.

4.Gain Real-World Experience - demonstrate your value by volunteering your skills to help your community and participating in Capture the Flag events to gain hands-on experience.

5.Choose Your Specialty - customize your career path by specializing in a specific area of cybersecurity, such as offense, defense, GRC, sales, or other specialties.

6.Stay Ahead of the Curve - stay up-to-date with the latest cybersecurity trends, techniques, and tools by attending security conferences, reading blogs, and constantly improving your skillset.

7.Build Your Reputation - establish your professional presence online through social media, websites, blogs, podcasts, and other outlets. Give back to the cybersecurity community by sharing your knowledge and expertise.

8.Get Involved - gain exposure by participating in cybersecurity events and workshops, and volunteering to speak or teach whenever possible.

9.Stay Ethical - maintain a sterling reputation by always adhering to industry standards and best practices, and never attempting to breach security systems without permission.

10.Hone Your Soft Skills - sharpen your communication, problem-solving, and teamwork skills, which are essential to your success in the fast-paced world of cybersecurity.

By following these 10 steps, you'll be well on your way to building a successful and rewarding career in cybersecurity. Don't just dream about it – cheat your way to the top with these powerful tips and tricks!

Ransomware Response Plan

2023-05-11T22:38:00.004+10:00

Here are the key steps for an effective response plan:

1. Don't Panic:

- Stay calm and act purposefully when targeted by ransomware.

- Seek help from security vendors or report the incident to your insurance company.

2. Isolate Your Systems and Stop the Spread:

- Identify the range of the attack and implement network-level blocks or device-level isolation.

- Utilize endpoint detection and response (EDR) technology to block the attack at the process level.

3. Identify the Ransomware Variant:

- Determine the specific strain of ransomware to understand its behavior and possible decryption options.

4. Identify Initial Access:

- Determine the entry point of the attack to close security holes

. - Consult digital forensics teams and incident response experts if needed.

5. Identify All Infected Systems and Accounts (Scope): -

Identify active malware and persistent elements in systems communicating with the command-and-control server.

6. Determine if Data Was Exfiltrated:

- Look for signs of data exfiltration, such as large data transfers or unusual communications.

7. Locate Your Backups and Determine Integrity: -

Ensure backup technology was not affected and scan backups for integrity.

8. Sanitize Systems or Create New Builds:

- Remove malware and incidents of persistence, or consider creating new, clean systems

. - Implement appropriate security controls to prevent reinfection.

9. Report the Incident:

- Report the incident and determine if law enforcement should be involved. Consider legal obligations regarding regulated data.

10. Paying the Ransom?

- Law enforcement advises against paying the ransom

. 11. Conduct a Post-Incident Review:

- Evaluate the ransomware response and identify areas for improvement.

- Simulate attack scenarios and consider proactive playbook building.

- Consider external services if IT or security team staffing is limited.