Securonix Connect!

Recent activity
Help others
Categories

Securonix Threat Labs Monthly Intelligence Insights – June 2026Blog

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar Introduction: The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Labs in June 2026. The report also includes a s

300

4 days ago

Dheeraj KumarCommunity Manager

Threat Research & Intelligence

JADEPUFFER: Agentic Ransomware for Automated Database ExtortionBlog

Executive summary: Sysdig Threat Research reporting from July 2026 describes JADEPUFFER as an extortion operation in which an LLM-based agent appears to have performed many tactical intrusion steps after initial access: host discovery, credential col

690

5 days ago

Dheeraj KumarCommunity Manager

Threat Research & Intelligence

Cisco Catalyst SD-WAN Manager CVE-2026-20245 exploitation briefingBlog

CVE-2026-20245 matters as a control plane compromise that can lead to root access on Cisco Catalyst SD-WAN control components. The issue affects the CLI in Cisco Catalyst SD-WAN Controller, Manager, and Validator, which were formerly known as vSmart,

370

13 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

400

13 days ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

Operation Poisson: How a Junior Cybercriminal Built Persistence That Outlived His C2Blog

OverviewBetween March 30 and May 1, 2026, Cato CTRL researcher Vitaly Simonovich tracked a French-speaking cybercriminal known by the handle "Poisson" through every command of a 33-day intrusion operation. The result was 339 recorded commands, four c

360

17 days ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

The "Gentlemen" RaaS and the GentleKiller EDR-Killer FrameworkBlog

TL;DRThe Gentlemen (operators tracked by Microsoft as Storm-2697) is a Russian-speaking, financially motivated ransomware-as-a-service operation that emerged mid-2025 from a Qilin affiliate split; its distinguishing feature is that operators centrall

1540

17 days ago

Dheeraj KumarCommunity Manager

Threat Research & Intelligence

FortiBleed: Credential Exposure at the Network EdgeBlog

FortiBleed should be treated as an edge-credential exposure event. If a FortiGate administrator or SSL VPN account is valid and exposed, an attacker may not need a new exploit. They may be able to log in directly. Public reporting describes a creden

530

17 days ago

icervantesCommunity Manager

Getting started in the community

💡 Have a Product Idea? Help Shape the Future of Securonix

Have a Product Idea? Help Shape the Future of Securonix Innovation at Securonix is driven by you — our customers and partners. Whether you’ve identified a gap, experienced a challenge, or have an idea for a new feature, we want to hear from you. We’

2382

24 days ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

BETA DETECTION: ErrTraffic ClickFix C2 API Endpoint PatternBlog

name: ErrTraffic ClickFix C2 API Endpoint Pattern Analyticsignatureid: PXY-WEB10-RUNcategory: 'Command and Control'threatname: 'Application Layer Protocol: Web Protocols'functionality: 'Web Proxy'description: | Detects outbound HTTP requests matchin

580

25 days ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

BETA DETECTION: ErrTraffic ClickFix XOR-Decoded PowerShell DropperBlog

name: ErrTraffic ClickFix XOR-Decoded PowerShell Dropper Analyticsignatureid: WEL-PSH135-RUNcategory: 'Defense Evasion'threatname: 'Obfuscated Files or Information: Command Obfuscation'functionality: 'Microsoft Windows Powershell'description: | Dete

560

25 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

400

13 days ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

480

1 month ago

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

911

1 month ago

martel.williamsNew Member

Use Cases

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

410

2 months ago

makayla.smithNew Member

Use Cases

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

2292

2 months ago

martel.williamsNew Member

Show & Tell

Cloudflare WAF logs are not showing in the platform

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

1932

2 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2072

3 months ago

martel.williamsNew Member

Use Cases

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

1921

3 months ago

BrillNew Participant

Use Cases

How can I display amalgamated vulnerability intelligence on a dashboard?

I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d

1471

3 months ago

Ak_098New Member

Tips & Tricks

IOC Enrichment Malware Attribution Gaps and Alternative Approaches

Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to

1521

5 months ago