4 ms·
Interesting to me that the attackers were well equipped in their phish and 0days, but then opted to drop fairly detectable RATs.
by ianhawes 7y ago
Interesting to me that the attackers were well equipped in their phish and 0days, but then opted to drop fairly detectable RATs.
- staticassertion 7y agoYeah, they could have moved processes before execing the shell. Detecting "Firefox + Shell" is quite easy and standard, even in existing SIEMs. Detecting "arbitrary program + shell" is at least moderately more difficult. It's the attacker's dilemma though. They only need to trip one alarm to trigger IR.
- notathing 7y agoThe biggest fail here was that 32 bit program warning, which probably alerted the employee. Notice that they didn't actually have an alert for Firefox+Shell, they detected that later by inspecting the audit logs.
- staticassertion 7y ago> We detected the attacker at this stage, based on a number of behaviors (e.g. Firefox shouldn’t spawn a shell). They explicitly state it was one of the behaviors they detected as suspicious.
- dead_mall 7y agoI was thinking the same thing. The RAT they used is well known in underground skiddie forums; it's known for being expensive and shitty.
- repolfx 7y agoVery likely that they bought the exploit and did the rest themselves, so, their skill at phishing, exploiting and RATing won't be correlated.