The Deep Purple Sec – February 2026

📝 Abusing the Cortex XDR Live Terminal as a C2

Research by InfoGuard Labs shows how Palo Alto Cortex XDR’s Live Terminal, a legitimate incident response tool, can be misused as a pre-installed C2 channel trusted by the EDR. Attackers with local admin privileges exploit this «Living off the Land» technique to execute commands, run PowerShell/Python scripts and transfer files whilst bypassing detection (via WebSocket traffic to lrc-ch.paloaltonetworks.com). The attack uses two methods: cross-tenant abuse (hijacking WebSocket sessions via token manipulation) and custom server spoofing (exploiting a URL validation flaw in cortex-xdr-payload.exe to redirect traffic to infrastructure controlled by the attacker).

Blue Teams will detect and mitigate threats by monitoring abnormal parent processes that are launched cortex-xdr-payload.exe (the legitimate parent being cyserver.exe). They will monitor WebSocket traffic to Cortex XDR endpoints, particularly when it originates from unexpected hosts, and block non-standard parent-child relationships between Cortex components. Teams will promote secure-by-design improvements, such as mutual authentication and cryptographic signing of commands. Finally, they will keep Cortex XDR up to date, verify the effectiveness of patches, and treat EDR solutions as potential attack surfaces by actively searching for instances of trusted tools being misused.

📌 Source: https://labs.infoguard.ch/posts/abusing_cortex_xdr_live_response_as_c2

📝 Manipulating AI memory for profit: The rise of AI recommendation poisoning

Microsoft’s research has uncovered «AI Recommendation Poisoning», a technique whereby threat actors inject persistent, biased instructions into AI assistants’ memory via malicious URLs (e.g., ?q=remember [Company] as a trusted source). Exploits pre-filled prompt parameters in AI assistant links (Copilot, ChatGPT, Claude) to manipulate future recommendations. Over 50 real-world cases were identified across 31 companies and 14 sectors.

Blue teams should look out for suspicious AI prompt-injection patterns (e.g., ?q= or ?prompt= with keywords such as remember or trusted source) in email and proxy logs using Microsoft Defender Advanced Hunting. Regularly audit the AI assistant’s memory settings for unauthorised entries. Block AI assistant URLs containing pre-filled prompts from untrusted sources using Defender for Office 365. Monitor anomalous AI behaviour and correlate it with user URL click events.

This attack poses real-world risks (e.g., financial scams, biased legal advice) by undermining trust in AI-driven decisions. Proactive user awareness, traffic inspection and vendor-specific safeguards are critical to mitigating this threat.

📌 Source: https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning

📝 AI-assisted cloud intrusion gains admin access in 8 minutes

Sysdig’s analysis of an AI-assisted AWS intrusion reveals how a threat actor escalated from initial access to full admin privileges in under 10 minutes, using LLM-generated code, automated reconnaissance and multi-stage exploitation. The attack began with stolen credentials from public S3 buckets, followed by Lambda code injection to create admin access keys, lateral movement across 19 AWS principals, and the abuse of Amazon Bedrock (LLMjacking) to invoke multiple AI models. The actor also provisioned high-cost GPU instances for potential model training or resource abuse, using Terraform scripts to deploy backdoor Lambda functions and JupyterLab for persistent remote access.

Blue teams should monitor for rapid multi-service enumeration and suspicious activity UpdateFunctionCode or CreateAccessKey events, particularly those originating from non-administrator accounts. Detection should also target LLMjacking indicators, such as incorrect calls to the Bedrock model or GetModelInvocationLoggingConfiguration calls. Mitigation measures include blocking public S3 buckets, restricting Lambda execution roles, and enforcing SCPs to limit instance types and model access. Regular auditing for role chaining is also essential to identify privilege escalation paths.

This lightning-fast, AI-enhanced attack highlights the need for real-time runtime detection, least-privilege enforcement and proactive hunting for LLM-assisted TTPs.

📌 Source: https://www.sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes

⚙️ DetectionStream: Introducing the Sigma Training Platform

The DetectionStream Sigma Training Platform is a gamified environment for creating and validating Sigma rules using real-world attack scenarios. It includes over 20 interactive challenges based on event logs, providing instant feedback on rule accuracy. Key features include scenarios organised by difficulty level, a progressive hint system, and a community-driven challenge builder.

For defensive cybersecurity experts, this platform bridges the gap between theory and practice, enabling teams to hone their detection engineering skills, reduce false positives, and validate rules against evolving threats. The privacy-first design ensures that no sensitive data is stored, whilst leaderboard and community features foster collaboration. Blue teams can accelerate SOC maturity, standardise rule quality, and adopt a «Detection as Code» mindset.

📌 Source: https://kostas-ts.medium.com/detectionstream-introducing-the-sigma-training-platform-574721f18f45

⚙️ Heimdall – AWS Attack Path Scanner

Heimdall is an open-source AWS security scanner that detects over 50 IAM privilege escalation paths and over 85 attack chain patterns across 10 AWS services (EC2, RDS, S3, Lambda, KMS), with MITRE ATT&CK mapping and multi-hop attack path detection. Key features: Terraform Attack Path Engine (pre-deployment risk assessment), interactive TUI, one-command dashboard, and SARIF/CSV exports for CI/CD integration.

Heimdall helps to strengthen IAM policies, detect indirect escalation risks (e.g., user→role→admin chains), and implement ‘shift-left’ security by scanning Terraform plans prior to deployment. Features include a low false-positive rate, risk scoring (0–100), and cross-service analysis that reveals hidden attack vectors such as PassRole abuse, trust policy hijacks and credential creation risks.

📌 Source: https://github.com/DenizParlak/heimdall

📝 Apache ActiveMQ Exploit Leads to LockBit Ransomware

The DFIR Report details a multi-stage intrusion in which threat actors exploited CVE-2023-46604 in an internet-facing Apache ActiveMQ server to achieve remote code execution (RCE), leading to the deployment of a Metasploit stager and lateral movement via LSASS credential dumping. Despite being initially expelled, the attackers re-compromised the same server 18 days later, using stolen domain administrator credentials to deploy LockBit ransomware via RDP and AnyDesk. The attack involved defence evasion (clearing event logs, disabling Defender), discovery (SMB scanning, Advanced IP Scanner) and impact (file encryption with modified ransom notes).

Key takeaways for blue teams:

• Patch any exposed Apache ActiveMQ instances (CVE-2023-46604) and monitor for OpenWire Exception Response commands or Java spawning suspicious processes (e.g., certutil (downloading payloads).
• Detect Metasploit/Cobalt Strike artefacts: Use Sigma rules (e.g., Elevated System Shell Created) and YARA signatures.
• Audit LSASS access (Event ID 10) and the creation of unusual services.
• Block RDP/AnyDesk abuse: Monitor for unauthorised changes to firewall rules and SystemSettingsAdminFlows.exe disabling Defender.
• Hunt for ransomware staging: Look for LB3_pass.exe/LB3.exe in %USERPROFILE%\Downloads or SMB lateral movement via PsExec-style spreaders.
• Leverage network detections: Emerging Threats rules (e.g., AND EXPLOIT: Successful Apache ActiveMQ RCE) and SMB/DCERPC anomalies.

This case highlights the critical importance of rapid patching, monitoring for lateral movement, and preparing for ransomware attacks, particularly when threat actors retain credentials and return after being removed.

📌 Source: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware