Security Validation

logs and  deployment  instances should be  filtered with  time  

The Mandiant Advantage Security Validation (MA-SV) team is pleased to announce version 5.14.4.0 of the MA-SV platform. This version is scheduled to be deployed on Tuesday, April 28 at 8:00AM EDT (12:00PM UTC). During this time, users might experience brief disruptions accessing the service. Full service will be restored no later than 9:00AM EDT (1:00PM UTC).  On the day of release, the release notes will be posted on the Security Validation MA-SV (SaaS) release notes page.

Many MSV deployments include multiple on-premise actors and one or two Mandiant cloud hosted actors. Many use cases like data extraction or malicious file transfers (MFT) will require that the on-premise actors can communicate with the cloud hosted actor. Mandiant requires clients to submit a list of public IP addresses that the on-premise actors will use to communicate with the cloud hosted actor. The MSV operator often does not know this information and may resort to an internal ticket or inquiry to a network administrator to find this information out and that can take more time than wanted. A simple and faster alternative is to create Host-CLI actions utilizing the cURL utility to identify the egress IP address of each on-premise actor. Yes, this works on network actors as they are linux based and can run Host-CLI actions using a bash shell. An action for multiple shell types can be similarly created as cURL is supported on many OS platforms including windows (cmd.exe or po

Hello everyone,I'd like to share with the community a thing we did internally to use the MSV Library with the MITRE ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/).This job was made in collaboration with my colleagues from the CSIRT team.We had two objectives:"plot" the MSV Library on the MITRE ATT&CK matrix using layers (https://github.com/mitre-attack/attack-navigator/tree/master/layers).overlaying the MSV library with custom layers or layers from MITRE to extract the list of actions corresponding to the techniques that are common to the two layers.The approach we developed is very simple and it's the following:analyse MSV Library and collect a list of VIDs for every technique.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260407 - Content Expansion. This content pack requires Director version 4.14.1.00/94-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes300 Actions added 191 Files added 274 Actions updatedRelease HighlightsNew Actions related to the Actors, Malware, and Vulnerabilities in the M-Trends 2026 Report

VHR20260401 - April 1, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260401 - Content Expansion. This content pack requires Director version 4.14.1.00/94-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes171 Actions added 98 Files added 1 Action updatedRelease HighlightsA new Action covering APT34, an Iranian state-sponsored cyber

VHR20260401 - April 1, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260401 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes171 Actions added 98 Files added 1 Action updatedRelease HighlightsA new Action covering APT34, an Iranian state-sponsored cyber esp

Strategic Proposal: Neutralizing AI Prompt Injection via Recursive Honey-potting​Submitted by: Adam EehanReference ID: VRP 493408185Topic: Active Cyber-Defense & AI Security​1. The Problem: Prompt Injection​Current Large Language Models (LLMs) like Gemini are vulnerable to "Prompt Injection" attacks, where malicious users trick the AI into bypassing safety filters or revealing internal system instructions.​2. The Solution: Recursive Honey-potting​Instead of just blocking an attack, my strategy involves creating a "Digital Trap".​The Mechanism: When the system detects a suspicious or high-risk prompt, it doesn't just say "Access Denied." Instead, it triggers a Recursive Honey-pot.​The Decoy: The system serves the attacker "Decoy Data" (fake but realistic-looking internal info).​The Trap: As the attacker tries to use or dig deeper into this decoy data, the system recursively creates more fake layers, keeping the

Project ID: topical-proSite URL: topical-pro.web.appHello,My Firebase project has been suspended for "Phishing," resulting in a "Site Not Found" error. I believe this is a false positive and would like to request a manual review to reinstate the project.Project Context: This is an educational resource site providing independent study guides for students.Why this is a False Positive: No Sensitive Data Collection: The site does not contain any login forms, password fields, or requests for personal/financial information. Independent Educational Content: While the site mentions exam boards (Pearson/Cambridge) in a legal disclaimer, it is a non-affiliated resource library for students. Harmless Logic: The Firebase Realtime Database scripts are

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260306 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes382 Actions added 231 Files addedRelease HighlightsNew Actions covering UNC3313, an Iran-nexus cyber espionage group observed targeting Middle Eastern government, telecommunications, an

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260304 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes72 Actions added 30 Files addedRelease HighlightsNew Actions demonstrating Campaign 26-009, a campaign distributing Node.js-based malware via fake trading installers, utilizing a 'B

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.5.0 of the MSV platform.EnhancementsSeparated Actor and Protected Theater updates into distinct packages and updated the Director to use these new packages. Added a deprecation notice for the Legacy Crowdstrike Integration and prevented new API calls. Replaced Redis 7.2 with Valkey 8 and added the Valkey RPM to security updates. Added the capability for Event Filter Rules to detect on match. Improved MSI Correlation Query options. Correlation configuration is only displayed for correlation-enabled Integrations. Added a warning message when users attempt to use a deprecated integration. Cloud Profiles are retained when rescheduling a previously cancelled scheduled Cloud Action. Addressed inaccuracies in MSV API documentation. Improved the responsiveness of the /manage_sims/v2/Actions/library_Actions_list

Mandiant Security Validation (MSV) is an automated and continuous approach to testing the efficacy of an organization's security controls against cyber threats. Security Validation is informed by timely threat intelligence and executes automated and continuous testing of security controls with the use of real attacks. Effective security requires more than just implementing controls. Understanding their real-world effectiveness is crucial for protecting your organization from cyber threats. Mandiant Security Validation tackles this challenge by providing a comprehensive solution to test and evaluate your security posture. Reactive Testing allows you to assess your security posture as it relates to recent events that may have occurred in your environment. Findings from any incident response can be used to create custom actions within MSV. These custom actions can the

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260204 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes50 Actions added 30 Files addedRelease HighlightsNew Actions demonstrating Campaign 25-082, a suspected Iranian espionage threat actor 

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260204 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes50 Actions added 30 Files addedRelease HighlightsNew Actions demonstrating Campaign 25-082, a suspected Iranian espionage threat actor 

My Gmail and apple along with  associated apps were hacked by someone having gitggub and workspace apps / console and other command prompt based systems..  This being the case since oct 2024 . He has admin access and can see everything and anything i do   He has downloaded and deleted my data, changedmy passwords, lockedme  out of my accounts and is black mailings me Google and apple are clueless and can't offer me any assistance  Anyone able to honour 

I have an MSV Director account but am unable to access Mandiant documentation.Legacy accounts in our organization still have access, whereas newer accounts do not.Is documentation access managed separately after the Google acquisition?If so, could you please advise on which role is required or how users can request access to Mandiant documentation? 

The Mandiant Intelligence Validation Research Team (VRT) has published VBR20260121. This content pack requires Director version 4.14.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes634 Actions retired 5 Sequences retired 8 Evaluations retired 3662 Actions updated 48 Sequences updated 17 Evaluations updated 959 Files updatedRelease HighlightsUpdated all content metadata to conform to current standards. For full details on this release, see the 

Hello Google Cloud Community,I am seeking advice and potential assistance regarding a prolonged OAuth verification process for our Google Workspace Add-on. This add-on is crucial for a key client project, and the delays are now causing significant business impact, including the risk of losing the client. Timeline:31st October 2025: Initial request submitted to Google for add-on listing on the Google Workspace Marketplace.1st November 2025: Received first feedback to update manifest file configurations and to initiate a OAuth verification sensitive and restricted OAuth scopes.3rd November 2025: Initiate add-on submission for OAuth verification for sensitive and restricted OAuth scopes.6th November 2025:Received first feedback from OAuth verification team to update instructions to navigate into OAuth consent screen. Team provided instruction on the same date.

As a reminder to customers, the MSV releases security patches regularly.  These patch OS packages as well as provides updated MSI packages for Security Integrations with MSV.  It is highly recommended that customers keep an eye on the MSI Service release notes listing page (located here) to see if a release of the MSI service needs to be updated on your system.  A security patch (for non-package installs) upgrade will update the MSI service.  There is a process for package installs, so reach out to your technical point of contact if you have a package install and would like to upgrade your MSI version.Customers on a hosted director (hosted by Google Cloud Security/Mandiant) do not need to address updates to the MSI service. Updated Security Patches are located

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.4.1 of the MSV platform.EnhancementsUpgraded Director appliances to PostgreSQL 16. Upgraded Redis from 7.2.9 to 7.2.11. Added additional control over whether matched events count as "detections" or "alerts."Bug fixesFixed an issue where Cloud Validation Evaluations would not display Cloud Logs when running multiple Cloud Actions. Fixed an issue where the Clone and Edit button was missing for all Cloud Validation Actions, preventing users from cloning existing Cloud Actions. Fixed an issue where the gauge within a data-looped Template Section behaved inconsistently, changing its appearance after the report date range was modified. Fixed an issue where Integration Event Filter Rules were not consistently suppressing or dropping events, particularly for MDE events that were correlated. Fixe

As of today, the MSV action library has over eight thousand actions.  (Wow, I remember when we had a little over 2k!) Figuring out which actions to run (because we don’t have time to run ALL of them) can seem like a daunting challenge.  When asked by customers to show them which actions to run, I tend to go through the following questions:Has a baseline been completed? (If not, baselines need to be done.  We have recommendations on how to do that here.) Are we only interested in the actions newly released from the Validation Research Team? Or are historical actions of interest as well? What actors are in the environment? (It’s very hard to do egress network testing without an actor outside the network, as an example.) Do we want to run action

A lot of API automation for MSV needs to use a list of the actions in MSV to “do things.”  The default endpoint used by many customers is GET /manage_sims/actions.json.  But this endpoint is very heavy.  (And will return ALL of the data for over 7k actions!)  Depending on your connection (and resources available to your director) this may take a while and potentially timeout.There is a better way, and it is using GET /manage_sims/v2/actions/library_actions_list which takes the following parameters:order_by - MSV itself uses the value ‘last_added’ which has worked well in all applications this author has needed page_number - The page number of results to pull down.  MSV starts counting at zero. page_size - The number of elements to return per page direction - the order to put the order_by column.  ‘asc’ is the value this author uses primarily.The best way to use this endpoint if you want to pull the entire repository of activ

The MSV UI calls API endpoints to do tasks, just as scripts can, if needed.One task that I have been asked about is pulling a backup via a scripting language.The endpoint for pulling a backup is GET /settings/create_backup.  It takes a parameter include_ssl_cert which can be true (to include the certificate) or false (to not include the server certificate).  Assuming one has variable for a requests Session (with correct authentication setup) and the hostname or IP address of your director, a segment of your code to pull a copy of the backup in Python 3 could look like the following:endpoint = f'https://{DIRECTOR_IP}/settings/create_backup?include_ssl_cert=false'with session.get(endpoint,stream=True) as response: c = response.headers['content-disposition'] file_name = re.findall("filename=(.+)",c)[0] file_name = file_name.replace('"',"") with open(f'./{file_name}','wb') as f: f

Customers often use /jobs.json to pull a list of jobs when doing API calls that needs that information.  This works, but is also a heavy API call on MSV.  There is a more efficient way, but this requires more total API calls: /jobs/list_page_data.  This requires the parameters of a page number (page), sort column (sortCol, I use ‘job_time’), sort direction (sortDir, I use desc) and a size per page (size, I typically use 200). In Python 3, your call might look like the following:jobs_response = session.get(f'https://{director_ip}/jobs/list_page_data', data {'page':str(page),'sortCol':'job_time', 'sortDir':'desc', 'size':str(size)})The way to work this in the code is to iterate through pages (starting at zero) until the length of job results returned from the API call is less than the size you denoted in the call.