Security Validation

VHR20251126 - November 26, 2025The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251126 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes89 Actions added 66 Files added 20 Actions retired 13 Actions updatedRelease Highlights New Actions demonstrating Campaign 25-059, used by UNC6322 to deploy SHADOWLADDER.IDAT payloads in multiple compromises of US and French organizations. New Actions demonstrating Campaign 25-058, a financially motivated actor UNC6276 campaign compromising ESXi infrastructure and Windows domain environments for ransomware deployment by exploiting CVE-2024-370

I am writing to appeal the phishing suspension on my Firebase Hosting site: https://drama-logbook.web.app/ Project ID: drama-logbook Project number: [removed by moderator] Abuse Event Insert ID: [removed by moderator] 896651 (timestamp: 2025-11-22T16:19:32Z)This is a personal, non-commercial drama/theatre logbook web app that I built myself. It has been running normally for over two weeks (deployed around early November 2025) and was actively used by me and a few friends until yesterday afternoon (Hong Kong time, Nov 22). Suddenly last night it started showing “Site Not Found” with a RESOURCE_SUSPENSION triggered for alleged phishing.I believe this is a false positive for the following reasons:The site contains no login forms, no password fields, no credit-card or financial information collection, and no redirects to external phishing sites. The only

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251126 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes89 Actions added 66 Files added 20 Actions retired 13 Actions updatedRelease HighlightsNew Actions demonstrating Campaign 25-059, used by 

We have received a note from our internal security team to investigate if Google cloud and BigQuery integrations that we have now with Google are used in transferring/saving any of our customer level data in the google cloud. How can i confirm back if that’s happening or not?

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251030 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes4 Actions addedRelease HighlightsNew Actions covering CVE-2025-59287, a Deserialization of Untrusted Data vulnerability that allows a remote attacker to execute arbitrary code and has been e

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251015 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes54 Actions added 41 Files added 2 Actions updated 37 Files updatedRelease HighlightsNew Actions covering BRICKSTORM, a backdoor used by 

We are releasing two core Python-based tools to the public:  VRT-SDK: A powerful Python library that serves as a dedicated API client for the MSV platform. It

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250917 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes41 Actions added 35 Files added 27 Actions updatedRelease HighlightsNew Actions demonstrating Campaign 25-042, a North Korean actor 

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.4.0 of the MSV platform.EnhancementsAdjusted Report Builder to work with sub-dimensions. Upgraded nginx SSL directive. Added additional Alternate name support for Actors to match multiple possibilities in the security controls and SIEM. Added MFA Registration Status in the User Management page. Upgraded the inetsim image in Protected Theater. Updated Actors to OpenSSL3. Updated reported Actor OS information in Director web interface. Newly-released Actor images have an /opt location with 20 GB of space. MSV requires encryption in the database.yml file using vconfigdb or vsetdb without providing a root certificate.Bug fixesFixed an issue where Directors showed an error when trying to pull content through an NTLM proxy connection.

Olá, comunidade,Estou enfrentando um problema  e preciso muito de ajuda. Sou estudante e estou tentando usar uma API do Gemini, mas minha conta parece estar bloqueada.Resumo do problema: Estou aceitando um erro "429 - Quota Exceeded" na primeira requisição que faço para a API do Gemini, mesmo em um projeto totalmente novo e configurado do zero.O que já foi feito (sem sucesso): 1. Meu código Python está correto e só faz uma requisição por vez (não está em loop). 2. Criei uma conta de faturamento e o vinculei corretamente ao meu projeto ativo. 3. Confirme que a "Generative Language API" está ATIVADA no projeto. 4. Criei mais de um projeto e chaves de API novas; o erro persiste em todos eles. Tudo indica que a cota padrão gratuita da API do Gemini não foi provisionada corretamente para minha conta Google Cloud. Não importa o que eu faça, meus projetos herdam esse status de "cota zero".Alguém do Google poderia, por f

Just wanted to introduce myself and see if anyone else was using MSV as part of their detection engineering practice.We've been using a test-driven detection process for about a year now. Getting intel tasks, building MSV tests, then creating detection against the SIEM events. We're working on scheduling for ongoing automated validation.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250820 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes47 Actions added 28 Files added 3 Actions updated 3 Files updatedRelease HighlightsNew Action demonstrating Campaign 25-029, a financially motivated threat actor campaig

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250724 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes39 Actions added 37 Files added 35 Actions updated 11 Files updatedRelease HighlightsNew Action demonstrating CVE-2025-53770, an Improper Limitation of a Pathname to

VHR20250708 - July 8, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250708 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 3 Actions added 1 File added Release Highlights New Action c

An evaluation is a list of actions tied together in groups for execution in the Mandiant Security Validation Platform. Evaluations are part of a core set of functionality that allows customers to test their environment in a repeatable manner. The Validation Research Team releases some evaluations as part of the content packs made available to customers through the content service or through the Security Validation documentation portal. Evaluations are not just for the VRT, though! Building an evaluation starts by visiting the Action Library in MSV. (Library → Actions) Once one has picked an action, it may be added to the queue. After a series of actions are added to the queue, the queue may be saved as an evaluation using the steps provided on our documentation portal. The important par

VHR20250625 - June 25, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250625 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.3.2 of the MSV platform (On-prem). Enhancements Upgraded Redis 6.2 to Redis 7.2.9.  Bug fixes Fixed an issue where the shutdown button under Settings > Director Settings was not working.  Fixed an issue where a Director did not load after an upgrade. Fixed an issue where the Job Processor service stopped after an upgrade, preventing users from scheduling simulations. Fixed an issue in Mandiant Threat Intelligence Integration with a network timeout during the sync which would preven

Planned Maintenance for MSV Updater Service On Tuesday, June 24 at 9AM EDT, Mandiant Security Validation will undergo planned maintenance. This maintenance is expected to last no longer than 1 hour and service should be restored by 10AM EDT. This maintenance window applies to both on-prem and SaaS customers. During the maintenance time frame, do not attempt to perform the following updates: Directors (on-prem only) Actors Content

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250521 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250423 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 37 Actions added 30 Fil

Starting with MSI version 1.7.1.0, the support for Netskope V2 API was released as Public Preview. You can use the new V2 API using the standard integration, and specify which API version you want to use (V2 is the default option, as the V1 API is end of life). Documentation is available here: https://docs.mandiant.com/home/msv-netskope-integration

The Mandiant Intelligence Validation Research Team (VRT) has published VBR20250320. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director (see The Mandiant Content Service and 

We submitted the Google Auth Verification over 5 days ago, but we still haven't received any initial response from the Google Trust and Safety team. What should we do?

VHR20250115 - January 15, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250115 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes

One of the common tasks we perform is troubleshooting integrations between MSV and various SIEM solutions. In this example, I'll provide a custom Splunk audit query used to troubleshoot legacy integrations. The same concept applies to other SIEM solutions. Beyond the initial configuration and connection phase, it's beneficial to track the queries executed by the MSV Director. This helps troubleshoot advanced issues or estimate the required query rate limit. For legacy Splunk integrations, providing the API username in this query displays MSV search activities with a human-readable time format. The query returns multiple "count" fields because it yields several events that Splunk's time filters later refine. The minimum count value is what MSV receives.   index=_audit user=<MSV API User> | eval s