Skip to main content

Security Validation

Welcome to the Security Validation forum! Ask questions, connect, share your expertise, and stay up-to-date on the latest conversations.

  • 80 Topics
  • 78 Replies
80 Topics
mikemeeks
Staff
mikemeeksStaff
posted in Security Validation
MSV 4.14.4.0 Product Release - September 4, 2025

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.4.0 of the MSV platform.EnhancementsAdjusted Report Builder to work with sub-dimensions. Upgraded nginx SSL directive. Added additional Alternate name support for Actors to match multiple possibilities in the security controls and SIEM. Added MFA Registration Status in the User Management page. Upgraded the inetsim image in Protected Theater. Updated Actors to OpenSSL3. Updated reported Actor OS information in Director web interface. Newly-released Actor images have an /opt location with 20 GB of space. MSV requires encryption in the database.yml file using vconfigdb or vsetdb without providing a root certificate.Bug fixesFixed an issue where Directors showed an error when trying to pull content through an NTLM proxy connection. Fixed an issue where IPTables were not kept after an upgrade. Fixed an issue where Directors did not allow changes to capitalization of a user account. Fixed an issue where AEDA Mon

100
mikemeeks
Staff
rafarauber
rafarauberNew Member
asked in Security Validation
[URGENTE] Conta presa com erro 429 na API do Gemini - Cota gratuita não está sendo aplicada

Olá, comunidade,Estou enfrentando um problema  e preciso muito de ajuda. Sou estudante e estou tentando usar uma API do Gemini, mas minha conta parece estar bloqueada.Resumo do problema: Estou aceitando um erro "429 - Quota Exceeded" na primeira requisição que faço para a API do Gemini, mesmo em um projeto totalmente novo e configurado do zero.O que já foi feito (sem sucesso): 1. Meu código Python está correto e só faz uma requisição por vez (não está em loop). 2. Criei uma conta de faturamento e o vinculei corretamente ao meu projeto ativo. 3. Confirme que a "Generative Language API" está ATIVADA no projeto. 4. Criei mais de um projeto e chaves de API novas; o erro persiste em todos eles. Tudo indica que a cota padrão gratuita da API do Gemini não foi provisionada corretamente para minha conta Google Cloud. Não importa o que eu faça, meus projetos herdam esse status de "cota zero".Alguém do Google poderia, por favor, investigar o provisionamento da minha conta? O ID do meu último proj

151
ErikaB
Community Manager
msvwrangler
msvwranglerNew Member
posted in Security Validation
Using MSV for Detection Engineering Quality Assurance

Just wanted to introduce myself and see if anyone else was using MSV as part of their detection engineering practice.We've been using a test-driven detection process for about a year now. Getting intel tasks, building MSV tests, then creating detection against the SIEM events. We're working on scheduling for ongoing automated validation.

148
kentphelps
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
Validation Content Update - August 20, 2025

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250820 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes47 Actions added 28 Files added 3 Actions updated 3 Files updatedRelease HighlightsNew Action demonstrating Campaign 25-029, a financially motivated threat actor campaign that uses callback phishing to steal data from legal sector entities in the United States. New Actions demonstrating Campaign 25-031, a China-nexus actor TEMP.Hex campaign that uses spearphishing and DLL hijacking to deliver LIGHTPIPE and WEIRDEGG malware. New Actions demonstrating Campaign 25-033, where an unknown threat actor used compromised webpages to deliver LUMMAC.V2 payloads. New Actions demonstrating Campaign 25-037, a

290
chrisf
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
VHR20250724 - July 24, 2025

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250724 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes39 Actions added 37 Files added 35 Actions updated 11 Files updatedRelease HighlightsNew Action demonstrating CVE-2025-53770, an Improper Limitation of a Pathname to a Restricted Directory vulnerability in Microsoft SharePoint Server that allows remote code execution and has been exploited in the wild by UNC6337. New Actions demonstrating Campaign 25-027, an APT36 campaign targeting Indian government and defense sectors via the SEEDOOR backdoor. New Actions demonstrating activity by UNC3313, an Iran-nexus cyber espionage group targeting Middle Eastern government, telecommunications, and technolo

440
chrisf
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
Validation Content Update - July 8, 2025

VHR20250708 - July 8, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250708 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 3 Actions added 1 File added Release Highlights New Action covering CVE-2025-22457, a Stack-based Buffer Overflow vulnerability in Ivanti Connect Secure, exploited by suspected China-nexus actors UNC4936 and UNC5221. New Action covering CVE-2025-5777, an Out-of-bounds Read vulnerability in Citrix NetScaler that allows for security bypass. New Action covering CVE-2025-6543, a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that allows remote code execution and has been exploited in the wild. For full detai

200
chrisf
Staff
Ismahan
Staff
IsmahanStaff
posted in Security Validation
Creating Effective Evaluations for Testing using Mandiant Security Validation

An evaluation is a list of actions tied together in groups for execution in the Mandiant Security Validation Platform. Evaluations are part of a core set of functionality that allows customers to test their environment in a repeatable manner. The Validation Research Team releases some evaluations as part of the content packs made available to customers through the content service or through the Security Validation documentation portal. Evaluations are not just for the VRT, though! Building an evaluation starts by visiting the Action Library in MSV. (Library → Actions) Once one has picked an action, it may be added to the queue. After a series of actions are added to the queue, the queue may be saved as an evaluation using the steps provided on our documentation portal. The important part of this process is finding actions to add, and how to organize the evaluations. It is recommended to build an evaluation that focuses on a specific use case. So testing a particular scenario may requir

120
Ismahan
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
Validation Content Update - June 25, 2025

VHR20250625 - June 25, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250625 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 25 Actions added 16 Files added 57 Actions updated Release Highlights New Actions related to Campaign 25-004, a phishing campaign targeting Chrome extension developers conducted by UNC5978. New Actions demonstrating Campaign 25-017, a financially motivated threat actor UNC2465 campaign that uses malvertising to deploy PASTAPUNCH and SMOKEDHAM, sometimes leading to LOCKBIT ransomware. New Action demonstrating Campaign 25-019, a financially motivated actor UNC6138 campaign that de

240
chrisf
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
MSV Product Update 4.14.3.2 - June 24, 2025

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.3.2 of the MSV platform (On-prem). Enhancements Upgraded Redis 6.2 to Redis 7.2.9.  Bug fixes Fixed an issue where the shutdown button under Settings > Director Settings was not working.  Fixed an issue where a Director did not load after an upgrade. Fixed an issue where the Job Processor service stopped after an upgrade, preventing users from scheduling simulations. Fixed an issue in Mandiant Threat Intelligence Integration with a network timeout during the sync which would prevent the synchronization from running to completion. Known issues Local Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV. Network configuration ma

80
chrisf
Staff
mikemeeks
Staff
mikemeeksStaff
posted in Security Validation
Planned MSV Maintenance on June 24, 2025 (Upgrader Service)

Planned Maintenance for MSV Updater Service On Tuesday, June 24 at 9AM EDT, Mandiant Security Validation will undergo planned maintenance. This maintenance is expected to last no longer than 1 hour and service should be restored by 10AM EDT. This maintenance window applies to both on-prem and SaaS customers. During the maintenance time frame, do not attempt to perform the following updates: Directors (on-prem only) Actors Content

10
mikemeeks
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
VHR20250521 - May 21, 2025

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250521 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 22 Actions added 19 Files added 977 Actions updated Release Highlights New Actions related to the Actors, Malware, and Vulnerabilities in the M-Trends 2025 Report. The M-Trends 2025 Report provides trends analysis, metrics, and learnings drawn from the frontlines of Mandiant incident response investigations and threat intelligence findings between January 1, 2024 - December 31, 2024. New Actions demonstrating Campaign 23-022, a suspected Chinese espionage campaign targeting US-based organizations in the defense, technology, and telecommunications sectors. New Actio

30
chrisf
Staff
chrisf
Staff
chrisfStaff
posted in Security Validation
VHR20250423 - April 23, 2025

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250423 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 37 Actions added 30 Files added Release Highlights New Actions demonstrating Campaign 24-078, an India-nexus espionage actor UNC1687 campaign leveraging CVE-2017-0199 and CVE-2023-38831 to target government, defense, and maritime shipping entities in South and East Asia. New Action demonstrating Campaign 24-079, a campaign leveraging FAKETREFF to deploy and execute the VOLTMARKER downloader along with the NIGHTROPE dropper. New Actions demonstrating Campaign 24-080, a suspected China-nexus actor UNC59

290
chrisf
Staff
dge
Staff
dgeStaff
posted in Security Validation
Support for Netskope V2 API Release

Starting with MSI version 1.7.1.0, the support for Netskope V2 API was released as Public Preview. You can use the new V2 API using the standard integration, and specify which API version you want to use (V2 is the default option, as the V1 API is end of life). Documentation is available here: https://docs.mandiant.com/home/msv-netskope-integration

51
paolocarrara
chrisf
Staff
chrisfStaff
posted in Security Validation
VBR20250320 - March 20, 2025

The Mandiant Intelligence Validation Research Team (VRT) has published VBR20250320. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director (see The Mandiant Content Service and Managing Security Validation Content for full details). Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 18 Actions retired 7530 Actions updated 1 Sequences updated 4 Evaluations updated 23 Files retired 17 Files updated Release Highlights Updated all content metadata to conform to current standards. Retired Security Content With this release, 18 Actions and 23 Files have been retired.   See content release notes for additional details: Release Notes

00
chrisf
Staff
D
dcmobserverNew Member
posted in Security Validation
How Google Auth Verification Start?

We submitted the Google Auth Verification over 5 days ago, but we still haven't received any initial response from the Google Trust and Safety team. What should we do?

51
ErikaB
Community Manager
chrisf
Staff
chrisfStaff
posted in Security Validation
Validation Content Update - January 15, 2025

VHR20250115 - January 15, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250115 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 10 Actions added 8 Files added Release Highlights New Actions demonstrating malware identified in an ongoing campaign targeting vulnerable Ivanti Connect Secure VPN appliances. This campaign involves the exploitation of a zero-day vulnerability, as detailed in Google Cloud's Threat Intelligence report: Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. New Actions demonstrating Campaign 24-073, a financially motivated campaign distributing infostealer malware via fake software installers. For full details on this release, se

60
chrisf
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
Useful Splunk Audit Query for Integrations Troubleshooting

One of the common tasks we perform is troubleshooting integrations between MSV and various SIEM solutions. In this example, I'll provide a custom Splunk audit query used to troubleshoot legacy integrations. The same concept applies to other SIEM solutions. Beyond the initial configuration and connection phase, it's beneficial to track the queries executed by the MSV Director. This helps troubleshoot advanced issues or estimate the required query rate limit. For legacy Splunk integrations, providing the API username in this query displays MSV search activities with a human-readable time format. The query returns multiple "count" fields because it yields several events that Splunk's time filters later refine. The minimum count value is what MSV receives.   index=_audit user=<MSV API User> | eval search_et_ts=strftime(search_et ,"%m/%d/%y %H:%M:%S") | eval search_lt_ts=strftime(search_lt ,"%m/%d/%y %H:%M:%S") | eval indextime_ts=strftime(_indextime ,"%m/%d/%y %H:%M:%S") | eval

22
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
MSV Operational Status and Monitoring

This post will discuss briefly the operational readiness tests in MSV, as this feature is sometimes overlooked. There are several situations that could degrade an MSV deployment, for example ; Time skew : The MSV actor host relies on its time for the matching algorithm between the actions executedand the returned events from an integration. Gradually the MSV actors time would skew from the director's time causing possible time mismatching betwee the events and host time. Integrations Failing : For example this could happen when a service account expires, or the target integration platform is down. This would cause the integrations events detection to fail thus impacting the actions result. MSV has already built-in features to detect and possibly alert for performance impacting issues like this by following these steps ; Activate the different test on https://<MSV URL>/settings/operational_status  . There are different test available including Director/Remote Int

40
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
Exporting MSV Actions using Python API

  This post will cover how to bulk-export MSV Action details. The actions info could be useful in building a different categorization or understanding the actions coverage. A possible use case is to pass the actions descriptions to an LLM to generate a different fine-tuned categorization, for example this is a snippet of categorizing Cloud Actions into finer categories by an LLM  ; Another use case is to use "verodin_tags" column to generate statistics about the different actions Vs MITRE tags (e.g. ATT&CK:T1082). This column has multiple tags categories like like Malware, APT, ..etc that could be leverage to build visualization matrices per threats. The code snippet provided is expands the library descried in a previous post by adding the getActions() function to msvlib_simple.py snippet. The few extra lines provided will just parse the data into Pandas dataframe. The actions info will be fetched by ; actions = getActions() : GET : manage_sims/actions : Empty

30
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
MSV Scheduled Jobs Exporting and Editing Using Python API

  This post will discuss briefly how to modify MSV Scheduled jobs programmatically using MSV API.  Python with several external libraries including Pandas will be used in this demo. The msvlib_simple.py is a simple library file I coded with some wrapper functions for demo purposes. I personally prefer using interactive python interpreters for this task. During this demo you would need to replace "app.validation.mandiant.com" with your MSV director hotsname if you are using an on-prem instance. Also we will use this notation as a shorhand for the API calls with some comments about the body if needed;   return = Function name in Library(): HTTP Method : API Endpoint : Comment about Payload   First prepare a credentials file credentials.txt with this format for example ; [hdr] Content-Type = application/json Accept = application/json Authorization = Bearer xxx= Mandiant-Organization = UUID xxxx url_base = https://app.validation.mandiant.com/ The API keys are genera

70
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
How to Create Endpoint Host CLI Custom Actions

This post is a short explanation for some of the parameters in MSV Custom Actions Editor, for an advanced use case please refer to this excellent post by @TomAtGoogle  ; https://www.googlecloudcommunity.com/gc/Security-Validation/Advanced-Host-CLI-Usage/m-p/770623#M118The simplest way is to pick a similar endpoint action from Library > Actions > Filter by Endpoint > Clone From the far right side. We will pick this action ; Host CLI - Workstation User Enumeration - VIDA104-205 as an example. In the "HOST CLI" section in the action details you would see ;dir C:\\Users Attack successful if zero exit Cloning this action will start the custom actions wizard, and will create a placeholder for a custom action. Custom actions VID start with VID200. The options available are ; Action User Profile: Selects the user account this action will run as. Require Interactive Session: Always No for Host-CLI actions. Check https://docs.mandiant.com/hom

140
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
Adding Custom Security Technologies

Security Technologies information will show up in MSV Director detections in the job results and reports. Their metadata is already defined in MSV under Director Settings > Security Technologies > Default Config For example this is an excerpt from the definition for Crowdstrike Falcon The definition provided gives us some info on how the tool is idenfieid ; Metadata : vendor name,  logo, type ,... Discovery: This is how the Actor/Director infer that Crowdstrike Falcon exists on a host/in the logs. The discovery is done via the "endpoint"  (If MSV actor detects a service with the name "CSFalconService") or via Splunk (If MSV Director fetched events with a field name called _sourcetype with value "crowdstrike:falconhost:json"). Prevention: This is how the Actor/Director can confirm that the event was blocked by the security technology. Done using Regex within the log fields. In this example MSV Director will report that the tool blocked the action when "Blocked" or

00
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
MSV Bulk Jobs with Tags

One of the common requirements is how to manage executing an evaluations on a large number of actors. This is a good use case to use bulk jobs and tags. A possible case is to assign tags to different actors (for example "Internal" to corporate internal actors and "External" to cloud or external actors), then Run a Data-Exfiltration oriented evaluation as a bulk job between the "Internal" to "External" Tags instead of actors. MSV Director will map the evaluation bulk job into a series of jobs from the different "Internal" actors to the designated "External Actors".e.g: If you have 2 Internal actors and 2 External actors, The Bulk Job should be configured between Internal to Exteran, and it will end up generating 4 jobs ; Job1: "Actor_Int1 Internal" --> "Actor_Ext1 External" Job2: "Actor_Int1 Internal" --> "Actor_Ext2 External" Job1: "Actor_Int2 Internal" --> "Actor_Ext1 External" Job2: "Actor_Int2 Internal" --> "Actor_Ext2 External" You can assign the tags to the actors fr

10
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
Customizing Pass/Fail Options for Actions Results

In this post I will highlight a useful feature in customizing the actions results.When an action is executed, the outcome result is evaluated based on 2 criteria ; Detection and Prevention. Prevented: An action is prevented (Prevented=True) when the destination actor does not receive the payload or expected result. Detected: An action is detected (Detected=True) when MSV Manager receives an event from one of the integrations mapped successfully to the action executed (Same timestamp range, same src/dst IP or host, same port ,...etc). Pass/Fail: The action is considered Pass or Fail depending on the configuration in Settings > Director Settings > Pass/Fail. The default configuration is ; State=Pass when Either (Prevented=True OR Detected=True).However this behavior can be tuned on 3 levels ; Globally for all actions. For specific VIDs (Verodin Action IDs). For specific dimensions (action categories).     You could tune your configuration to instead rely on bot

20
AbdElHafez
Staff
AbdElHafez
Staff
AbdElHafezStaff
posted in Security Validation
Basic Reports in MSV Report Builder

In this post, I will demonstrate how to generate a simple report using MSV Report Builder Begin by navigating to Analyze > Report Builder > Create New Report. The report will generate visualizations and data tables based on the job results. Selecting Datasource : Specify the time range for the report, then include the logical filter. Note that you can select multiple filtering conditions and fields. Adding Panels: Select one of the available panels, which are templates for the visualizations/datatable. There are three main types ; Layout panels which organize or split the layout into multiple panels, data visualization panels which contain the charts, and content widgets which contain the text-based data like data tables or text blocks. In this example we will pick the data table since it is the basis for using any CSV-reader analysis tools. Panel Configuration: For this example, required table columns are added to the datatable. In addition, another data filter can be applied o

50
AbdElHafez
Staff

Badge winners

  • Comments Posted 5
    spanugantihas earned the badge Comments Posted 5
  • Authored Posts 1
    Cook942has earned the badge Authored Posts 1
  • Comments Posted 25
    bsalvatorehas earned the badge Comments Posted 25
  • Comments Posted 1
    masaya.gotouhas earned the badge Comments Posted 1
  • Comments Posted 5
    keiShas earned the badge Comments Posted 5
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.