[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

official (recommendations from Bitdefender's 3AM case, Nov 3; Windows event IDs per Microsoft documentation)

Tip: three cheap, high-signal ransomware alerts from the 3AM school case: new AD domain trusts, reads of the Veeam credentials table, and reg save of SAM/SECURITY/SYSTEM

  • Domain trusts: alert on Windows Security event 4706 (a trust to a domain was created) and 4716 (trust information modified) on domain controllers, and on any netdom trust or dnscmd … /zoneadd … /forwarder process execution. Put trust changes behind change control.
  • Backup credentials: alert when anything other than the Veeam service queries [VeeamBackup].[dbo].[Credentials] (SQL audit), or when PowerShell on a backup server calls ProtectedData]::Unprotect. Scope Veeam accounts per domain and keep immutable copies no domain account can delete.
  • Hive dumps: alert on reg save HKLM\SAM, HKLM\SECURITY or HKLM\SYSTEM outside known backup jobs, and on remote access to the winreg pipe from workstations.
  • Coverage gap: every action in this case came from an internal machine without an EDR agent. Reconcile your asset list against EDR enrollment; unmanaged hosts are where attackers stage.

Sources: Bitdefender: 3AM Hits European Schools: A Hybrid AI Ransomware Attack · Microsoft Learn: Event 4706, a new trust was created to a domain