The Deep Purple Sec – March 2025

📝 CodeQLEAKED – Exposure of Public Secrets Leads to a Supply Chain Attack on GitHub CodeQL
A researcher discovered a publicly exposed secret in a GitHub Actions workflow artefact, which could have led to a supply chain attack on GitHub CodeQL, GitHub’s code analysis engine. The secret, a GitHub App token, had full write privileges and could have been used to create branches, push files and create tags in repositories. The researcher was able to create a new branch, push a file and create a tag using the token before it expired, demonstrating the potential impact of the vulnerability.

GitHub acknowledged the issue and temporarily disabled the workflow that uploaded the token, and later assigned it a CVE number. The researcher recommended minimising the risk of secrets being exposed by only uploading specific files or directories as workflow artefacts, avoiding the upload of artefacts containing environment variables, and restricting GITHUB\_TOKEN permissions to read-only.

📌 Source: https://www.praetorian.com/blog/codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql/

📝 SAML roulette: the hacker always wins
This article describes a vulnerability in the Ruby-SAML library, which is used by GitLab Enterprise for SAML authentication. This flaw allows an attacker to gain unauthenticated administrative access by exploiting «round-trip» attacks and namespace confusion.

Researchers discovered that differences in the way the REXML and Nokogiri parsers handle XML documents can be exploited to bypass signature verification, enabling an attacker to impersonate another user. Although GitHub has patched this vulnerability, the full technical details are being shared to improve overall security by raising awareness of these types of threats.

📌 Source: https://samcurry.net/hacking-subaru

📝 Glpwnme
glpwnme is a tool used to check for vulnerabilities in running instances of GLPI. It has been released by Orange CyberDefense on GitHub.

📌 Source: https://github.com/Orange-Cyberdefense/glpwnme

📝 Defending the land – Thinkst Scapes Q4 2024
The talk entitled «Defending off the land – Agentless defences available today» explores the concept of using only built-in operating system tools to enhance cyber defences, an approach known as «defending off the land» (DoL). Researchers developed 11 capabilities, including setting traps to detect attempts to use OS features such as Windows RDP or WinRM, and monitoring file access in specific directories. They also utilised the built-in Hyper-V virtualisation framework to deploy an OpenCanary honeypot, silently redirecting attackers to a virtual machine. In addition, a new capability enables the creation of fake SSO app registrations in IdP dashboards to detect attackers using stolen credentials.

BlackNoise’s view: Our Deep Purple Report 2025 confirms this observation. EDR/XDR-type tools cannot effectively detect the classic ‘living-off-the-land’ attack pattern. They must be supplemented by other approaches.

📌 Source: https://thinkst.com/ts//

📘 Looking Beyond the MITRE ATT&CK Assessment to the True Cost of Alert Volumes
MITRE’s latest ATT&CK Evaluation results were published in December 2024, with Forrester publishing several reports providing insights and cost calculations relating to the evaluation. Key findings include the difficulty of achieving true correlation and the high volume of alerts generated by some vendors, which can significantly impact incident responders and increase costs. The cost of excessive alerting was highlighted, with the cost of feeding alerts into a SIEM platform varying considerably between vendors.

📌 Source: https://www.forrester.com/blogs/go-beyond-the-mitre-attck-evaluation-to-the-true-cost-of-alert-volumes/

🛠️ Security lists for SOC/DFIR detections
A collection of useful lists relating to detection requirements (suspicious Windows services, suspicious Windows tasks, suspicious user-agents, etc.), IOCs, DFIR tools, and information intended for SOCs and Purple Teams

📌 Source: https://github.com/mthcht/awesome-lists

🛠️ Security lists for SOC/DFIR detections
The ANSSI report «Cloud Sector – State of Cyber Threats» (February 2025) highlights threats to cloud infrastructures, noting that whilst cloud computing offers flexibility, it poses significant cybersecurity challenges due to its complexity and reliance on providers.
The report identifies three main categories of threat:

• Profit-driven attacks: Exploiting vulnerabilities to carry out ransomware attacks or steal data.
• Espionage-driven attacks: Targeting cloud infrastructures for industrial and state espionage.
• Destabilisation attacks: DDoS attacks disrupt critical services.

The ANSSI notes that cybercriminals use cloud services for malicious activities and sets out 36 recommendations for security measures. It promotes the SecNumCloud label as a certification scheme for cloud services in France.

📌 Source: https://www.cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-001/