OPTIV/SOURCE ZERO

This article explores gaps that allow for the undetected execution of code on systems protected by Microsoft Defender Advanced Threat Protection.

We encourage clients to understand and adopt Palo Alto’s powerful credential theft prevention feature.

We reduced mean time to remediate by accelerating the processes from vulnerability discovery to the deployment of a corrective system update.

Firefox’s appsec add-ons make it a useful tool for new pen testers who can’t afford professional tools.

MobileIron MDM exposes account enumeration and SFA to unauthenticated attacks. This analysis details how to mitigate this vulnerability.

Given Office product functionality, it’s possible for adversaries to leverage Outlook's COM interface in attacks for extended persistence.

Captcha images don’t provide robust protection as a primary security control. This analysis explores how to prevent automated (bot) attacks.

Even when the hooks are removed, defenders can still leverage other EDR functions, such as host isolation for incident triage or remote.

This post identifies systemic endpoint detection and response issues and examines how attackers can bypass any EDR product.

Toolsets have evolved for high-fidelity forensics and investigations – here we map them to the MITRE ATT&CK framework for Enterprise Cloud.