Security Validation

We have received a note from our internal security team to investigate if Google cloud and BigQuery integrations that we have now with Google are used in transferring/saving any of our customer level data in the google cloud. How can i confirm back if that’s happening or not?

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.4.1 of the MSV platform.EnhancementsUpgraded Director appliances to PostgreSQL 16. Upgraded Redis from 7.2.9 to 7.2.11. Added additional control over whether matched events count as "detections" or "alerts."Bug fixesFixed an issue where Cloud Validation Evaluations would not display Cloud Logs when running multiple Cloud Actions. Fixed an issue where the Clone and Edit button was missing for all Cloud Validation Actions, preventing users from cloning existing Cloud Actions. Fixed an issue where the gauge within a data-looped Template Section behaved inconsistently, changing its appearance after the report date range was modified. Fixed an issue where Integration Event Filter Rules were not consistently suppressing or dropping events, particularly for MDE events that were correlated. Fixed an issue with Actor log rotation by reducing the rotation size to 25MB to prevent excessive disk space consumption. Fixe

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251030 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes4 Actions addedRelease HighlightsNew Actions covering CVE-2025-59287, a Deserialization of Untrusted Data vulnerability that allows a remote attacker to execute arbitrary code and has been exploited in the wild.For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251015 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes54 Actions added 41 Files added 2 Actions updated 37 Files updatedRelease HighlightsNew Actions covering BRICKSTORM, a backdoor used by UNC5221 and UNC6201 that can act as a web server, manipulate files, and run shell commands. New Actions detailing Campaign 25-051, in which financially motivated actor UNC6361 compromises SonicWall devices to deploy REDBIKE ransomware. New Actions demonstrating Campaign 25-056, a Chinese state-sponsored actor UNC6320 campaign leveraging VSPYTUNNEL. New Actions demonstrating Campaign 25-050, a campaign by financially motivated actors UNC6286 and UNC6016 leveragi

We are releasing two core Python-based tools to the public:  VRT-SDK: A powerful Python library that serves as a dedicated API client for the MSV platform. It simplifies programmatic interaction, allowing users to seamlessly integrate MSV into their existing security workflows and automation scripts. VRT-SDK Repository: https://github.com/mandiant/vrt-sdk  VRT-Auto: A user-friendly command-line tool, built upon the VRT-SDK, that automates the creation of new MSV Actions directly through integration with GTI and VirusTotal (VT). This dramatically reduces the time and effort required to build custom validation content. VRT-Auto Repository: https://github.com/mandiant/vrt-auto 

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250917 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes41 Actions added 35 Files added 27 Actions updatedRelease HighlightsNew Actions demonstrating Campaign 25-042, a North Korean actor UNC1069 campaign that uses advanced social engineering and deepfakes to deploy macOS malware for cryptocurrency theft. New Actions demonstrating Campaign 25-044, a China-nexus espionage campaign targeting legal services and software companies in the United States via the deployment of BRICKSTORM and SLAYSTYLE and reconnaissance with AZUREHOUND. New Actions demonstrating Campaign 25-045, an opportunistic campaign by UNC6186 delivering LUMMAC.V2. New Actions demonstra

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.4.0 of the MSV platform.EnhancementsAdjusted Report Builder to work with sub-dimensions. Upgraded nginx SSL directive. Added additional Alternate name support for Actors to match multiple possibilities in the security controls and SIEM. Added MFA Registration Status in the User Management page. Upgraded the inetsim image in Protected Theater. Updated Actors to OpenSSL3. Updated reported Actor OS information in Director web interface. Newly-released Actor images have an /opt location with 20 GB of space. MSV requires encryption in the database.yml file using vconfigdb or vsetdb without providing a root certificate.Bug fixesFixed an issue where Directors showed an error when trying to pull content through an NTLM proxy connection. Fixed an issue where IPTables were not kept after an upgrade. Fixed an issue where Directors did not allow changes to capitalization of a user account. Fixed an issue where AEDA Mon

Olá, comunidade,Estou enfrentando um problema  e preciso muito de ajuda. Sou estudante e estou tentando usar uma API do Gemini, mas minha conta parece estar bloqueada.Resumo do problema: Estou aceitando um erro "429 - Quota Exceeded" na primeira requisição que faço para a API do Gemini, mesmo em um projeto totalmente novo e configurado do zero.O que já foi feito (sem sucesso): 1. Meu código Python está correto e só faz uma requisição por vez (não está em loop). 2. Criei uma conta de faturamento e o vinculei corretamente ao meu projeto ativo. 3. Confirme que a "Generative Language API" está ATIVADA no projeto. 4. Criei mais de um projeto e chaves de API novas; o erro persiste em todos eles. Tudo indica que a cota padrão gratuita da API do Gemini não foi provisionada corretamente para minha conta Google Cloud. Não importa o que eu faça, meus projetos herdam esse status de "cota zero".Alguém do Google poderia, por favor, investigar o provisionamento da minha conta? O ID do meu último proj

Just wanted to introduce myself and see if anyone else was using MSV as part of their detection engineering practice.We've been using a test-driven detection process for about a year now. Getting intel tasks, building MSV tests, then creating detection against the SIEM events. We're working on scheduling for ongoing automated validation.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250820 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes47 Actions added 28 Files added 3 Actions updated 3 Files updatedRelease HighlightsNew Action demonstrating Campaign 25-029, a financially motivated threat actor campaign that uses callback phishing to steal data from legal sector entities in the United States. New Actions demonstrating Campaign 25-031, a China-nexus actor TEMP.Hex campaign that uses spearphishing and DLL hijacking to deliver LIGHTPIPE and WEIRDEGG malware. New Actions demonstrating Campaign 25-033, where an unknown threat actor used compromised webpages to deliver LUMMAC.V2 payloads. New Actions demonstrating Campaign 25-037, a

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250724 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes39 Actions added 37 Files added 35 Actions updated 11 Files updatedRelease HighlightsNew Action demonstrating CVE-2025-53770, an Improper Limitation of a Pathname to a Restricted Directory vulnerability in Microsoft SharePoint Server that allows remote code execution and has been exploited in the wild by UNC6337. New Actions demonstrating Campaign 25-027, an APT36 campaign targeting Indian government and defense sectors via the SEEDOOR backdoor. New Actions demonstrating activity by UNC3313, an Iran-nexus cyber espionage group targeting Middle Eastern government, telecommunications, and technolo

VHR20250708 - July 8, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250708 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 3 Actions added 1 File added Release Highlights New Action covering CVE-2025-22457, a Stack-based Buffer Overflow vulnerability in Ivanti Connect Secure, exploited by suspected China-nexus actors UNC4936 and UNC5221. New Action covering CVE-2025-5777, an Out-of-bounds Read vulnerability in Citrix NetScaler that allows for security bypass. New Action covering CVE-2025-6543, a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that allows remote code execution and has been exploited in the wild. For full detai

An evaluation is a list of actions tied together in groups for execution in the Mandiant Security Validation Platform. Evaluations are part of a core set of functionality that allows customers to test their environment in a repeatable manner. The Validation Research Team releases some evaluations as part of the content packs made available to customers through the content service or through the Security Validation documentation portal. Evaluations are not just for the VRT, though! Building an evaluation starts by visiting the Action Library in MSV. (Library → Actions) Once one has picked an action, it may be added to the queue. After a series of actions are added to the queue, the queue may be saved as an evaluation using the steps provided on our documentation portal. The important part of this process is finding actions to add, and how to organize the evaluations. It is recommended to build an evaluation that focuses on a specific use case. So testing a particular scenario may requir

VHR20250625 - June 25, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250625 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 25 Actions added 16 Files added 57 Actions updated Release Highlights New Actions related to Campaign 25-004, a phishing campaign targeting Chrome extension developers conducted by UNC5978. New Actions demonstrating Campaign 25-017, a financially motivated threat actor UNC2465 campaign that uses malvertising to deploy PASTAPUNCH and SMOKEDHAM, sometimes leading to LOCKBIT ransomware. New Action demonstrating Campaign 25-019, a financially motivated actor UNC6138 campaign that de

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.3.2 of the MSV platform (On-prem). Enhancements Upgraded Redis 6.2 to Redis 7.2.9.  Bug fixes Fixed an issue where the shutdown button under Settings > Director Settings was not working.  Fixed an issue where a Director did not load after an upgrade. Fixed an issue where the Job Processor service stopped after an upgrade, preventing users from scheduling simulations. Fixed an issue in Mandiant Threat Intelligence Integration with a network timeout during the sync which would prevent the synchronization from running to completion. Known issues Local Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV. Network configuration ma

Planned Maintenance for MSV Updater Service On Tuesday, June 24 at 9AM EDT, Mandiant Security Validation will undergo planned maintenance. This maintenance is expected to last no longer than 1 hour and service should be restored by 10AM EDT. This maintenance window applies to both on-prem and SaaS customers. During the maintenance time frame, do not attempt to perform the following updates: Directors (on-prem only) Actors Content

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250521 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 22 Actions added 19 Files added 977 Actions updated Release Highlights New Actions related to the Actors, Malware, and Vulnerabilities in the M-Trends 2025 Report. The M-Trends 2025 Report provides trends analysis, metrics, and learnings drawn from the frontlines of Mandiant incident response investigations and threat intelligence findings between January 1, 2024 - December 31, 2024. New Actions demonstrating Campaign 23-022, a suspected Chinese espionage campaign targeting US-based organizations in the defense, technology, and telecommunications sectors. New Actio

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250423 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 37 Actions added 30 Files added Release Highlights New Actions demonstrating Campaign 24-078, an India-nexus espionage actor UNC1687 campaign leveraging CVE-2017-0199 and CVE-2023-38831 to target government, defense, and maritime shipping entities in South and East Asia. New Action demonstrating Campaign 24-079, a campaign leveraging FAKETREFF to deploy and execute the VOLTMARKER downloader along with the NIGHTROPE dropper. New Actions demonstrating Campaign 24-080, a suspected China-nexus actor UNC59

Starting with MSI version 1.7.1.0, the support for Netskope V2 API was released as Public Preview. You can use the new V2 API using the standard integration, and specify which API version you want to use (V2 is the default option, as the V1 API is end of life). Documentation is available here: https://docs.mandiant.com/home/msv-netskope-integration

The Mandiant Intelligence Validation Research Team (VRT) has published VBR20250320. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director (see The Mandiant Content Service and Managing Security Validation Content for full details). Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 18 Actions retired 7530 Actions updated 1 Sequences updated 4 Evaluations updated 23 Files retired 17 Files updated Release Highlights Updated all content metadata to conform to current standards. Retired Security Content With this release, 18 Actions and 23 Files have been retired.   See content release notes for additional details: Release Notes

We submitted the Google Auth Verification over 5 days ago, but we still haven't received any initial response from the Google Trust and Safety team. What should we do?

VHR20250115 - January 15, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250115 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 10 Actions added 8 Files added Release Highlights New Actions demonstrating malware identified in an ongoing campaign targeting vulnerable Ivanti Connect Secure VPN appliances. This campaign involves the exploitation of a zero-day vulnerability, as detailed in Google Cloud's Threat Intelligence report: Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. New Actions demonstrating Campaign 24-073, a financially motivated campaign distributing infostealer malware via fake software installers. For full details on this release, se

One of the common tasks we perform is troubleshooting integrations between MSV and various SIEM solutions. In this example, I'll provide a custom Splunk audit query used to troubleshoot legacy integrations. The same concept applies to other SIEM solutions. Beyond the initial configuration and connection phase, it's beneficial to track the queries executed by the MSV Director. This helps troubleshoot advanced issues or estimate the required query rate limit. For legacy Splunk integrations, providing the API username in this query displays MSV search activities with a human-readable time format. The query returns multiple "count" fields because it yields several events that Splunk's time filters later refine. The minimum count value is what MSV receives.   index=_audit user=<MSV API User> | eval search_et_ts=strftime(search_et ,"%m/%d/%y %H:%M:%S") | eval search_lt_ts=strftime(search_lt ,"%m/%d/%y %H:%M:%S") | eval indextime_ts=strftime(_indextime ,"%m/%d/%y %H:%M:%S") | eval

This post will discuss briefly the operational readiness tests in MSV, as this feature is sometimes overlooked. There are several situations that could degrade an MSV deployment, for example ; Time skew : The MSV actor host relies on its time for the matching algorithm between the actions executedand the returned events from an integration. Gradually the MSV actors time would skew from the director's time causing possible time mismatching betwee the events and host time. Integrations Failing : For example this could happen when a service account expires, or the target integration platform is down. This would cause the integrations events detection to fail thus impacting the actions result. MSV has already built-in features to detect and possibly alert for performance impacting issues like this by following these steps ; Activate the different test on https://<MSV URL>/settings/operational_status  . There are different test available including Director/Remote Int

  This post will cover how to bulk-export MSV Action details. The actions info could be useful in building a different categorization or understanding the actions coverage. A possible use case is to pass the actions descriptions to an LLM to generate a different fine-tuned categorization, for example this is a snippet of categorizing Cloud Actions into finer categories by an LLM  ; Another use case is to use "verodin_tags" column to generate statistics about the different actions Vs MITRE tags (e.g. ATT&CK:T1082). This column has multiple tags categories like like Malware, APT, ..etc that could be leverage to build visualization matrices per threats. The code snippet provided is expands the library descried in a previous post by adding the getActions() function to msvlib_simple.py snippet. The few extra lines provided will just parse the data into Pandas dataframe. The actions info will be fetched by ; actions = getActions() : GET : manage_sims/actions : Empty