process[.]microsoftDomain
Reported by 1 independent source · first reported by Microsoft Security Blog · last reported
Last reported 24 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570“…cond-stage payload is retrieved over HTTP using standard download utilities with fallbacks, then launched as a detached background process[.]Microsoft Defender for Endpoint”
Indicators reported together
named in the same reports- oast[.]onlinein 1 report
- oast[.]funin 1 report
- requestrepo[.]comin 1 report
- hxxps://aka[.]ms/downloadazcopy-v10-linuxin 1 report
- wsweb03.blob.core.windows[.]netin 1 report
- credentials[.]microsoftin 1 report
- it[.]microsoftin 1 report
- processes[.]microsoftin 1 report
- attributes[.]microsoftin 1 report
- infrastructure[.]microsoftin 1 report
- psk1zim.abrdns[.]comin 1 report
- 117.107.25[.]243in 1 report
- 192.255.193[.]111in 1 report
- wslogzimbra.linkpc[.]netin 1 report
- mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]comin 1 report
- 45.32.30[.]235in 1 report
- 193.42.40[.]135in 1 report
- 3.209.137[.]175in 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2026-73570
Thanks — we review every report.