Threat video1:00
FOFA Queries Map 8 Malware Families: Analysis & Hunting
Embee Research's FOFA queries fingerprint malware C2 servers by TLS certificate, favicon and title: 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for FOFA Queries Map 8 Malware Families: Analysis & Hunting →
Chapters
- 0:00The hook57 exposed AsyncRAT servers, all defaults.
- 0:05The storyResearchers published FOFA queries.
- 0:11Attack pathDefaults in TLS certs, favicons and titles.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise4 indicators to hunt: 1 IP, 2 domains and 1 SHA-256 hash.
- 0:37MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation3 steps now: Run the published FOFA, Shodan and Censys certificate, favicon.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0057 exposed AsyncRAT servers, all defaults.
0:05Researchers published FOFA queries.
0:07Eight malware C2 families, all defaults.
0:12Defaults in TLS certs, favicons and titles.
0:15Internet scanners discover exposed C2 infrastructure.
0:19Defenders use FOFA queries to pivot and hunt.
0:25No threat actor is attributed. Confidence: low.
0:304 indicators to hunt: 1 IP, 2 domains and 1 SHA-256 hash.
0:389 ATT&CK techniques, from reconnaissance to command and control.
0:433 steps now: Run the published FOFA, Shodan and Censys certificate, favicon.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.