Attributed metadata history
Up to 100 retained publisher events per page for d5910bdf1afae8faf0356edd930442dfcb9725de83522b7b56af846029c30e2c. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🔒 Cisco Secure Access Threat Detection 🔒 Introduced new analytics for Cisco Secure Access to identify access to anonymizer and privacy-focused services as well as automated web reconnaissance activity. New detections — Cisco Secure Access Access to Anonymizer Services and Cisco Secure Access Automated Web Reconnaissance via HTTP Access Errors — help uncover attempts to obscure attacker infrastructure, evade attribution, and perform large-scale web application discovery through patterns of abnormal HTTP error responses and suspicious outbound connectivity. 🟦 🔨 BlueHammer & RedSun 🔨 🟦 Added new analytic stories and detections covering the BlueHammer and RedSun exploit families, which abuse Microsoft Defender functionality to achieve privilege escalation and credential access. New analytics detect suspicious Defender engine and signature update activity, non-administrative password changes, abnormal password reset bursts, unauthorized Defender file modifications, and processes interacting with Defender update components, while also introducing support for Windows Security Event ID 4723 (password change attempts) to improve visibility into
Fingerprint: 5dc1f6c01bd6c6a312bf36d1b648aa430afc597686040c3f45e092dd161fcce0
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c