#cortexxsiam — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #cortexxsiam, aggregated by home.social.
-
🛠️ Tool
===================Executive summary: AzureHound is an open-source Go-based data collection tool (distributed precompiled for Windows, Linux and macOS) that enumerates Entra ID and Azure resources using the Microsoft Graph and Azure REST APIs. It produces JSON output consumable by BloodHound to visualize relationships and potential attack paths for privilege escalation.
Key features:
• Automated enumeration of identities, groups, role assignments and Azure resources via Microsoft Graph and Azure REST API.
• JSON export format compatible with BloodHound for graph-based analysis of potential attack paths.
• Focus on discovering indirect escalation vectors across Entra ID and ARM-managed resources.Technical implementation:
• Written in Go and uses authenticated queries to both Microsoft Graph (identity plane) and Azure Resource Manager (control plane).
• Collects data points such as users, service principals, role assignments, subscriptions, resource groups and permissions relationships, then normalizes them to JSON for downstream graph analysis.
• Does not require execution from within the target tenant because the APIs it queries are externally accessible given appropriate credentials.Use cases:
• Red teams and penetration testers use AzureHound to map attack surface and privilege paths in preparation for controlled assessments.
• Adversaries with initial access can run AzureHound to accelerate discovery of high-value principals and misconfigurations enabling lateral movement or escalation.Limitations:
• Requires credentials or tokens that grant API access; the scope of data returned is limited by the permissions associated with those credentials.
• Enumerated data quality depends on API rate limits and permission scoping; not all environmental context (e.g., private artifacts outside ARM) may be captured.Detection and logging notes:
• Activities appear as Microsoft Graph and ARM API calls in Azure control-plane logs; monitoring API call patterns, unusual service principal usage, and large-scale enumeration queries can surface misuse.
• The article highlights mapping of AzureHound behaviors to the MITRE ATT&CK framework and notes how Cortex XSIAM and related products can enhance detection and incident response.References and tags:
• Tool: AzureHound; Integration: BloodHound; Data sources: Microsoft Graph, Azure REST API🔹 AzureHound #BloodHound #MicrosoftGraph #CortexXSIAM #tool
🔗 Source: https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/
-
Convert Sigma DNS Rules to Cortex XSIAM with Uncoder AI – Source: socprime.com https://ciso2ciso.com/convert-sigma-dns-rules-to-cortex-xsiam-with-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #socprimecom #SigmatoXQL #UncoderAI #socprime #Blog
-
Convert Sigma DNS Rules to Cortex XSIAM with Uncoder AI – Source: socprime.com https://ciso2ciso.com/convert-sigma-dns-rules-to-cortex-xsiam-with-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #socprimecom #SigmatoXQL #UncoderAI #socprime #Blog
-
Convert Sigma DNS Rules to Cortex XSIAM with Uncoder AI – Source: socprime.com https://ciso2ciso.com/convert-sigma-dns-rules-to-cortex-xsiam-with-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #socprimecom #SigmatoXQL #UncoderAI #socprime #Blog
-
Convert Sigma DNS Rules to Cortex XSIAM with Uncoder AI – Source: socprime.com https://ciso2ciso.com/convert-sigma-dns-rules-to-cortex-xsiam-with-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #socprimecom #SigmatoXQL #UncoderAI #socprime #Blog
-
Full Detection Logic for LITERNAMAGER in Cortex XSIAM via Uncoder AI – Source: socprime.com https://ciso2ciso.com/full-detection-logic-for-liternamager-in-cortex-xsiam-via-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #XQLdetection #CortexXSIAM #socprimecom #UncoderAI #socprime #Blog
-
Full Detection Logic for LITERNAMAGER in Cortex XSIAM via Uncoder AI – Source: socprime.com https://ciso2ciso.com/full-detection-logic-for-liternamager-in-cortex-xsiam-via-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #XQLdetection #CortexXSIAM #socprimecom #UncoderAI #socprime #Blog
-
Full Detection Logic for LITERNAMAGER in Cortex XSIAM via Uncoder AI – Source: socprime.com https://ciso2ciso.com/full-detection-logic-for-liternamager-in-cortex-xsiam-via-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #XQLdetection #CortexXSIAM #socprimecom #UncoderAI #socprime #Blog
-
Full Detection Logic for LITERNAMAGER in Cortex XSIAM via Uncoder AI – Source: socprime.com https://ciso2ciso.com/full-detection-logic-for-liternamager-in-cortex-xsiam-via-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #XQLdetection #CortexXSIAM #socprimecom #UncoderAI #socprime #Blog
-
AI-Driven IOC Conversion for Palo Alto Cortex XSIAM Queries – Source: socprime.com https://ciso2ciso.com/ai-driven-ioc-conversion-for-palo-alto-cortex-xsiam-queries-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CERT-UA14283 #CortexXSIAM #socprimecom #WRECKSTEEL #UncoderAI #socprime #Blog
-
AI-Driven IOC Conversion for Palo Alto Cortex XSIAM Queries – Source: socprime.com https://ciso2ciso.com/ai-driven-ioc-conversion-for-palo-alto-cortex-xsiam-queries-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CERT-UA14283 #CortexXSIAM #socprimecom #WRECKSTEEL #UncoderAI #socprime #Blog
-
AI-Driven IOC Conversion for Palo Alto Cortex XSIAM Queries – Source: socprime.com https://ciso2ciso.com/ai-driven-ioc-conversion-for-palo-alto-cortex-xsiam-queries-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CERT-UA14283 #CortexXSIAM #socprimecom #WRECKSTEEL #UncoderAI #socprime #Blog
-
AI-Driven IOC Conversion for Palo Alto Cortex XSIAM Queries – Source: socprime.com https://ciso2ciso.com/ai-driven-ioc-conversion-for-palo-alto-cortex-xsiam-queries-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CERT-UA14283 #CortexXSIAM #socprimecom #WRECKSTEEL #UncoderAI #socprime #Blog
-
Enhancing Cortex XQL Threat Detection with Full Summary in Uncoder AI – Source: socprime.com https://ciso2ciso.com/enhancing-cortex-xql-threat-detection-with-full-summary-in-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #FullSummary #socprimecom #UncoderAI #socprime #Blog
-
Enhancing Cortex XQL Threat Detection with Full Summary in Uncoder AI – Source: socprime.com https://ciso2ciso.com/enhancing-cortex-xql-threat-detection-with-full-summary-in-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #FullSummary #socprimecom #UncoderAI #socprime #Blog
-
Enhancing Cortex XQL Threat Detection with Full Summary in Uncoder AI – Source: socprime.com https://ciso2ciso.com/enhancing-cortex-xql-threat-detection-with-full-summary-in-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #FullSummary #socprimecom #UncoderAI #socprime #Blog
-
Enhancing Cortex XQL Threat Detection with Full Summary in Uncoder AI – Source: socprime.com https://ciso2ciso.com/enhancing-cortex-xql-threat-detection-with-full-summary-in-uncoder-ai-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #CortexXSIAM #FullSummary #socprimecom #UncoderAI #socprime #Blog
-
Unit42: CL0P Seeds ^_- Gotta Catch Em All! https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/ #CortexXpanse #CortexXSIAM #Ransomware #torrenting #CortexXDR #MOVEit #Linux #CL0P #Clop
-
Unit42: CL0P Seeds ^_- Gotta Catch Em All! https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/ #CortexXpanse #CortexXSIAM #Ransomware #torrenting #CortexXDR #MOVEit #Linux #CL0P #Clop
-
Unit42: CL0P Seeds ^_- Gotta Catch Em All! https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/ #CortexXpanse #CortexXSIAM #Ransomware #torrenting #CortexXDR #MOVEit #Linux #CL0P #Clop
-
Unit42: CL0P Seeds ^_- Gotta Catch Em All! https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/ #CortexXpanse #CortexXSIAM #Ransomware #torrenting #CortexXDR #MOVEit #Linux #CL0P #Clop
-
Unit42: CL0P Seeds ^_- Gotta Catch Em All! https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/ #CortexXpanse #CortexXSIAM #Ransomware #torrenting #CortexXDR #MOVEit #Linux #CL0P #Clop
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT
-
Unit42: Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/ #ThreatProtection #BRONZEPRESIDENT #StatelyTaurus #MustangPanda #threatactors #CL-STA-0044 #CortexXSIAM #Government #EarthPreta #CortexXDR #webshells #backdoor #RedDelta #WildFire #TA416
-
Unit42: Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government https://unit42.paloaltonetworks.com/analysis-of-three-attack-clusters-in-se-asia/ #BehavioralThreatProtection #ThreatProtection #StatelyTaurus #ChinaChopper #CobaltStrike #MustangPanda #threatactors #AlloyTaurus #CL-STA-0044 #CL-STA-0045 #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #WildFire #GALLIUM #APTs