Attackers can check your security visibility faster than you can configure it.
Here's an UNC group we track 😉 using Outlook home page (CVE-2017-11774) to check the target's attack surface and process creation & PowerShell event visibility - then sending it to domain-fronted C2.
Here's an UNC group we track 😉 using Outlook home page (CVE-2017-11774) to check the target's attack surface and process creation & PowerShell event visibility - then sending it to domain-fronted C2.
If some of the #PowerShell logging terms there were new to you, make sure you check out @matthewdunwoody's classic blog on visibility.ps1: fireeye.com/blog/threat-re… (it still holds up!)
I also plan to blog with more info on the first stage TTPs (not pictured) & hardening guidance.
I also plan to blog with more info on the first stage TTPs (not pictured) & hardening guidance.
Here’s the blog as promised on how this persists and removes the CVE-2017-11774 patch
https://twitter.com/itsreallynick/status/1202191316932874245
• • •
Missing some Tweet in this thread? You can try to
force a refresh
