#soc

Articles tagged with #soc

Abusing Content Delivery Networks (CDNs): Phishing, Malware, and Evasion
Content Delivery Networks (CDNs) like jsDelivr, Webflow CDN, CloudFront, and Google APIs are trusted internet infrastructure – and attackers are abusing that trust. By hosting malicious pages and payloads on CDN domains, adversaries exploit the domai...
May 24, 202515 min read1.4K
Threat Analysis: Investigating Suspicious Outbound Connections to cdn.jsdelivrs[.]com (Adware or Supply Chain Foothold?)
Alert Overview On May 8, 2025, analysts at the FPT SOC identified a cluster of outbound HTTP requests from several internal endpoints targeting the domain cdn.jsdelivrs[.]com. This domain, which resolves to IP 91.195.240.12, is registered under AS478...
May 21, 20253 min read939
Reducing Alert Fatigue: Automating the Triage of Microsoft Defender’s Internal Port Scanning Alerts
Introduction Modern security operations rely on automated alerting to detect reconnaissance activities within enterprise networks. However, when certain alerts trigger frequently, distinguishing between benign system behavior and true security threat...
Feb 23, 20255 min read559