Top attack vectors: November 2021

**November 2021 SOC monthly report:** The SOC observed a 10% rise in commodity malware incidents driven by phishing emails linking to macro-enabled Office documents—SquirrelWaffle accounted for ~25% of commodity malware attempts and commonly delivered Qakbot or CobaltStrike—and ongoing cryptojacking operations (XMRig, TNT Worm, and malicious npm packages) exploiting exposed cloud resources; the report provides detection rules (e.g., monitor Excel -> regsvr32 activity, network traffic to mining pools) and mitigation advice (disable macros, patch public-facing servers, secure S3 and cloud credentials).