{"id":52726,"date":"2024-11-21T07:00:00","date_gmt":"2024-11-21T07:00:00","guid":{"rendered":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/"},"modified":"2024-11-21T07:00:00","modified_gmt":"2024-11-21T07:00:00","slug":"stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence","status":"publish","type":"post","link":"https:\/\/cybersecurityupdate.net\/news\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/","title":{"rendered":"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence"},"content":{"rendered":"
\n
\n \t<\/i> Read Time:<\/span>7 Minute, 17 Second <\/div>\n\n <\/div>

Executive Summary<\/h3>\n

Establishing persistence on a system allows a threat actor continued access or process execution across system restarts or other changes. For this reason, monitoring for and investigating persistence indicators are key components of any robust cybersecurity platform.<\/p>\n

Two common persistence techniques are using AutoStart Execution of programs during system boot or logon (T1547<\/a>) and abusing scheduled task functions (T1053<\/a>). However, legitimate application activity also frequently involves AutoStart Execution and scheduled task functions, so defending against these techniques requires not only detection monitoring but also analysis by a cybersecurity professional.\u00a0<\/p>\n

During a recent incident involving a LevelBlue MDR SOC customer, an alarm that triggered for a Windows Autorun registry key for persistence was traced back to a potentially unwanted application (PUA). The PUA purportedly was acting as a PDF conversion application. A review of the initial alarm and relevant events revealed that the application had established a double layer of persistence by using both Scheduled Task creation and Autorun registry keys to execute JavaScript under the guise of a Chrome browser extension. Additional open-source intelligence (OSINT) tools identified the application as either a PUA or a potentially malicious file. An investigation was created for the customer with remediation recommendations and ultimately it was confirmed that the application was neither expected nor authorized within the customer\u2019s environment, and it was removed.<\/p>\n

The same application was later detected in another customer\u2019s environment, but in this case, the customer had added a related file hash to an exclusion list. Because the LevelBlue MDR SOC analyst had recently investigated the application and identified it as potentially malicious, they were able to recommend removing the hash from the exclusion list and instead adding it to a blocklist.<\/p>\n

Investigation<\/h3>\n

Initial Alarm Review<\/h4>\n

The investigation began with the LevelBlue analyst receiving an alarm that a Windows Autorun registry key named \u201cChromeBrowserAutoLaunch\u201d had been added on an endpoint in the customer environment. While at first glance this appeared to be a key set to auto-launch Chrome with a browser extension loaded, analysis of the source process command line revealed several items that warranted further investigation.<\/p>\n\n

Figure 1: The initial alarm for the autorun registry key creation<\/p>\n

\tThe \u201c\u2013no-startup-window\u201d option: although this is commonly used for legitimate purposes, it can also indicate an attempt to hide activity from the end user. The pathway of the extension being loaded showed it was not an extension that the user had installed from the Chrome webstore. The expected pathway for extensions from the webstore would be \u201cC:Users<username>AppDataLocalGoogleChromeUser DataDefaultExtensions\u201d. While a sideloaded extension could still be legitimate, this gave additional cause to identify the origin of the registry key and extension.
\n\tNo verifiable browser extension with the name \u201cExtension Optimizer\u201d was found in OSINT queries.\u00a0
\n\tAbuse of browser extensions (T1176<\/a>) is a known technique and malicious extensions have a history of being used for infostealing, adware, and browser hijack or redirect behaviors.\u00a0<\/p>\n

Expanded Investigation<\/h3>\n

Events Search<\/h4>\n

The analyst conducted an event search to identify the origin of the browser extension \u201cExtensionOptimizer\u201d. This search returned process creation events that revealed the registry key was being added by a node.exe JavaScript process executing from an AppData folder named \u201cPDFFlex\u201d in the pathway \u201cC:Users<username>AppDataLocalPDFFlexnode.exe\u201d. \u00a0An additional event was logged at the same time showing that node.exe was also being used to load the extension manually.<\/p>\n\n

Figure 2: Events showing the registry keys origin and manual loading of the extension<\/p>\n

The analyst searched for \u201cPDFFlex\u201d to understand if the application was common in the customer\u2019s environment and to obtain additional artifacts regarding its origin or nature. The search revealed the application\u2019s presence was anomalous and also uncovered events that could be used for further research.<\/p>\n

The analyst obtained the filename of the application\u2019s MSI installer, the version and publisher of the application, and an event that showed the creation of a daily scheduled task. This task was configured to execute \u201cnode.exe update.js \u2013check-update\u201d from the same \u201cPDFFlex\u201d folder pathway seen in the registry creation events. Further analysis showed that this task was responsible for executing the process that was creating the Autorun registry key in an apparent double layer of persistence established on the endpoint.\u00a0<\/p>\n\n

Figure 3: Scheduled task created to persistently add the registry key each day<\/p>\n\n

Figure 4: Event showing the name of the application\u2019s MSI installer file found in the user\u2019s downloads folder<\/p>\n\n

Figure 5: Installation event showing the version and publisher of the application \u201cPDFFlex\u201d<\/p>\n

Event Deep-Dive<\/h4>\n

The analyst then performed several OSINT searches using the information obtained in event searches to verify the use case and potential legitimacy of the application.\u00a0<\/p>\n

\tNo verifiable information was found for the MSI file \u201cFreePDF_49402039.msi\u201d or the publisher PDFFlex.io.\u00a0
\n\tThe analyst conducted a Whois search of the domain \u201cpdfflex.io\u201d and found that it was not registered. \u00a0
\n\tA web search for \u201cPDFFlex 3.202.1208.0\u201d returned a verdict of \u201cmalicious activity\u201d from the sandbox tool ANY.RUN, which provided a SHA256 file hash of 9c5d756045fd479a742b81241ccf439d02fc668581a3002913811a341278de43.\u00a0
\n\tA search of the hash on VirusTotal revealed that it had been flagged as potentially malicious by multiple security vendors, including Sophos and Fortinet.\u00a0
\n\tThe analyst leveraged SentinelOne Deep Visibility to confirm that the hash for the MSI file on the customer\u2019s endpoint matched the hash in the ANY.RUN report. At the time of the alarm, incidents were not being triggered on the hash. The SentinelOne tool also showed that the MSI file was signed by \u201cEclipse Media Inc,\u201d which proved key in a later incident for another LevelBlue customer.\u00a0<\/p>\n

Figure 6:Deep Visibility search in SentinelOne showing the file hash for the MSI file found on the endpoint<\/p>\n

Response<\/h3>\n

Building the Investigation<\/h4>\n

The analyst\u2019s investigation and OSINT research returned several points to indicate that the \u201cPDFFlex\u201d application was likely not a desired application in the environment:<\/p>\n

\tThe presence of the application on the endpoint was anomalous for the environment as events for it were not observed for other endpoints.
\n\tThe application had established what appeared to be a double layer of persistence by using a scheduled task and autorun registry key to create and launch an unverified browser extension \u201cExtensionOptimizer.\u201d
\n\tOSINT reports for the MSI file indicated potentially malicious behavior.<\/p>\n

Together, these data points indicated that the application was neither desired nor expected in the customer environment and could be classified as a PUA\/PUP, if not as outright malicious, and thus should be removed from the endpoint.<\/p>\n

Customer Interaction<\/h4>\n

The analyst created an investigation that detailed the findings regarding the application \u201cPDFFlex,\u201d the browser extension \u201cExtensionOptimizer,\u201d the observed persistence behaviors, and the findings of the OSINT research. They recommended that the customer reimage the endpoint or remove the associated AppData folders for \u201cPDFFlex\u201d and \u201cExtensionOptimizer\u201d the scheduled tasks, and the associated registry keys. Shortly after the initial investigation, the LevelBlue MDR SOC identified another endpoint in the customer\u2019s environment that was exhibiting the same persistence indicators under the application name \u201cPDFTool.\u201d The customer confirmed that the applications were not authorized and ultimately elected to remove the endpoints from service and replace them.<\/p>\n

While the MSI file initially did not trigger an alarm, several days after the investigation, its hash was added to the SentinelOne Cloud global blocklist and began to trigger alarms. During review of one of these for another customer, a LevelBlue analyst found that the customer had added a hash-based exclusion for a similarly named pdf-related MSI file with a different file hash but also signed by \u201cEclipse Media Inc.\u201d\u00a0<\/p>\n

This customer had previously observed the threat but added the hash to the exclusion list in SentinelOne due to no negative reports observed while researching the file using OSINT tools. The LevelBlue team\u2019s knowledge of the signer \u201cEclipse Media Inc\u201d along with their recent analysis of the application allowed them to inform the customer about the risks of the application. Based on the analyst\u2019s recommendation, the exclusion was removed and a blocklist action for the alternate hash was added instead.<\/p>\n

Conclusion<\/h3>\n

This incident highlights not only the need for monitoring and alerting on scheduled task and Autorun registry key creation but also the value of having expert analysis of these events. In this investigation, the analyst\u2019s use of OSINT and sandboxing tools such as ANY.RUN provided the critical context needed to protect the customer\u2019s environment from threats. In addition, the analyst\u2019s research and prior knowledge of the file signer \u201cEclipse Media Inc\u201d later proved key in protecting another LevelBlue customer that had created an exclusion for what was likely the same PUA under a different file hash.<\/p>\n

Read More<\/a><\/p>","protected":false},"excerpt":{"rendered":"

Executive Summary Establishing persistence on a system allows a threat actor continued access or process execution across system restarts or other changes. For this reason, monitoring for and investigating persistence indicators are key components of any robust cybersecurity platform. Two common persistence techniques are using AutoStart Execution of programs during system boot or logon (T1547) […]<\/p>\n","protected":false},"author":0,"featured_media":52727,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-52726","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"yoast_head":"\nStories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence - Cyber Security News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence - Cyber Security News\" \/>\n<meta property=\"og:description\" content=\"Executive Summary Establishing persistence on a system allows a threat actor continued access or process execution across system restarts or other changes. For this reason, monitoring for and investigating persistence indicators are key components of any robust cybersecurity platform. Two common persistence techniques are using AutoStart Execution of programs during system boot or logon (T1547) […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Security News\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-21T07:00:00+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence\",\"datePublished\":\"2024-11-21T07:00:00+00:00\",\"dateModified\":\"2024-11-21T07:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\"},\"wordCount\":1462,\"publisher\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/#organization\"},\"image\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png\",\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\",\"url\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\",\"name\":\"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence - Cyber Security News\",\"isPartOf\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png\",\"datePublished\":\"2024-11-21T07:00:00+00:00\",\"dateModified\":\"2024-11-21T07:00:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage\",\"url\":\"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png\",\"contentUrl\":\"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png\",\"width\":609,\"height\":448},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cybersecurityupdate.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cybersecurityupdate.net\/#website\",\"url\":\"https:\/\/cybersecurityupdate.net\/\",\"name\":\"Cyber Security News\",\"description\":\"News, Advisories and much more\",\"publisher\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cybersecurityupdate.net\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/cybersecurityupdate.net\/#organization\",\"name\":\"CyberSecurityUpdate\",\"url\":\"https:\/\/cybersecurityupdate.net\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cybersecurityupdate.net\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2022\/02\/logo_csu.png\",\"contentUrl\":\"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2022\/02\/logo_csu.png\",\"width\":640,\"height\":640,\"caption\":\"CyberSecurityUpdate\"},\"image\":{\"@id\":\"https:\/\/cybersecurityupdate.net\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence - Cyber Security News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/","og_locale":"en_US","og_type":"article","og_title":"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence - Cyber Security News","og_description":"Executive Summary Establishing persistence on a system allows a threat actor continued access or process execution across system restarts or other changes. For this reason, monitoring for and investigating persistence indicators are key components of any robust cybersecurity platform. Two common persistence techniques are using AutoStart Execution of programs during system boot or logon (T1547) […]","og_url":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/","og_site_name":"Cyber Security News","article_published_time":"2024-11-21T07:00:00+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#article","isPartOf":{"@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/"},"author":{"name":"","@id":""},"headline":"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence","datePublished":"2024-11-21T07:00:00+00:00","dateModified":"2024-11-21T07:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/"},"wordCount":1462,"publisher":{"@id":"https:\/\/cybersecurityupdate.net\/#organization"},"image":{"@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage"},"thumbnailUrl":"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png","articleSection":["News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/","url":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/","name":"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence - Cyber Security News","isPartOf":{"@id":"https:\/\/cybersecurityupdate.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage"},"image":{"@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage"},"thumbnailUrl":"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png","datePublished":"2024-11-21T07:00:00+00:00","dateModified":"2024-11-21T07:00:00+00:00","breadcrumb":{"@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#primaryimage","url":"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png","contentUrl":"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2024\/11\/Stories-from-the-SOC1-sWmRz5.png","width":609,"height":448},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecurityupdate.net\/uncategorized\/stories-from-the-soc-registry-clues-to-pdf-blues-a-tale-of-pua-persistence\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybersecurityupdate.net\/"},{"@type":"ListItem","position":2,"name":"Stories from the SOC: Registry Clues to PDF Blues: A Tale of PUA Persistence"}]},{"@type":"WebSite","@id":"https:\/\/cybersecurityupdate.net\/#website","url":"https:\/\/cybersecurityupdate.net\/","name":"Cyber Security News","description":"News, Advisories and much more","publisher":{"@id":"https:\/\/cybersecurityupdate.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecurityupdate.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cybersecurityupdate.net\/#organization","name":"CyberSecurityUpdate","url":"https:\/\/cybersecurityupdate.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecurityupdate.net\/#\/schema\/logo\/image\/","url":"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2022\/02\/logo_csu.png","contentUrl":"https:\/\/cybersecurityupdate.net\/wp-content\/uploads\/2022\/02\/logo_csu.png","width":640,"height":640,"caption":"CyberSecurityUpdate"},"image":{"@id":"https:\/\/cybersecurityupdate.net\/#\/schema\/logo\/image\/"}}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/posts\/52726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/comments?post=52726"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/posts\/52726\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/media\/52727"}],"wp:attachment":[{"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/media?parent=52726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/categories?post=52726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityupdate.net\/wp-json\/wp\/v2\/tags?post=52726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}