"sparkrat observed in exploitation of beyondtrust critical vulnerability ( cve - 2026 - 1731 ) a critical pre - authentication remote code execution vulnerability, cve - 2026 - 1731 ( cvss v4 9. 9 ), has been identified in beyondtrust remote support ’ s thin - scc - wrapper websoc…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
99%
"" a vulnerability discovered by adnan khan, which exploits a misconfigured github workflow where an ai agent ( claude ) with excessive permissions could be tricked via prompt injection in a github issue title to execute arbitrary code. this attack leveraged github actions cache p…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.001Compromise Software Dependencies and Development Tools
99%
"weekly threat bulletin – february 25th, 2026 cline cli 2. 3. 0 supply chain attack installed openclaw on developer systems on february 17, 2026, the open - source, ai - powered coding assistant cline cli experienced a supply chain attack where version 2. 3. 0 was published to the…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
86%
"details and iocs mitigation advice - immediately apply the vendor - supplied patches for all vulnerable beyondtrust remote support and privileged remote access instances to remediate cve - 2026 - 1731. - add the attacker ip addresses listed in the article ' s indicators of compro…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1611Escape to Host
81%
"a user already within a kata container to achieve arbitrary code execution as root inside the guest micro vm. the vulnerability stems from a breakdown in isolation, enabling direct manipulation of the underlying guest micro vm ' s filesystem from within the container environment.…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1525Implant Internal Image
81%
"or ' clawdbot '. - if an unauthorized openclaw runtime is discovered on a device, use microsoft defender for endpoint to isolate the device from the network while investigation occurs. compliance best practices - develop and enforce a security policy that requires any evaluation …"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
80%
"vulnerability was disclosed. - run the provided xql detection queries in your siem or xdr to hunt for signs of post - exploitation activity on windows and linux systems related to this threat. compliance best practices - develop and implement a network segmentation strategy to is…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
54%
"- poisoning - vulnerability / https : / / cyberpress. org / moltbot - operators - leak - control - panels - via - exposed - mdns - traffic / https : / / depthfirst. com / post / 1 - click - rce - to - steal - your - moltbot - data - and - keys https : / / gbhackers. com / 15200 -…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1083File and Directory Discovery
50%
"or filenames containing ' openclaw ', ' moltbot ', or ' clawdbot ' on endpoints. - using microsoft defender xdr, run a hunt query against ` cloudprocessevents ` to search for process command lines or filenames containing ' openclaw ', ' moltbot ', or ' clawdbot ' in cloud workloa…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1588.002Tool
49%
"repositories. - for any approved agent host, configure host - based or network firewalls to enforce strict egress filtering, allowing outbound connections only to a pre - approved list of destinations. - develop a specific incident response playbook for compromised ai agents, det…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1587Develop Capabilities
37%
"" a vulnerability discovered by adnan khan, which exploits a misconfigured github workflow where an ai agent ( claude ) with excessive permissions could be tricked via prompt injection in a github issue title to execute arbitrary code. this attack leveraged github actions cache p…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
37%
"lts 2. 541. 1 and earlier, stems from improper sanitization of user - provided descriptions for offline nodes, allowing attackers with agent / configure or agent / disconnect permissions to inject malicious scripts that execute in the browsers of users viewing the node ' s status…"
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.