Threat video1:00
Generic Stealer Weekly Report: Detection & IOCs
Generic Stealer hit 24,799 machines in Hudson Rock's weekly telemetry: 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Generic Stealer Weekly Report: Detection & IOCs →
Chapters
- 0:00The hookWeekly report: about 25,600 machines compromised by stealers.
- 0:06The storyFive stealer families hit targets worldwide.
- 0:13Attack pathAccording to reports, lures deliver ClickFix commands or installers.
- 0:30AttributionNo threat actor is attributed.
- 0:34Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques14 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation4 steps now: Treat any host with a confirmed infostealer as fully compromised.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Weekly report: about 25,600 machines compromised by stealers.
0:07Five stealer families hit targets worldwide.
0:09Generic led with about 25,000 machines.
0:13According to reports, lures deliver ClickFix commands or installers.
0:18Sideloading and unpacking rebuild the stealer quietly.
0:21The stealer harvests credentials, cookies and tokens.
0:25Dead-drop resolution exfiltrates logs to Hudson Rock.
0:30No threat actor is attributed. Confidence: low.
0:34No malicious indicators were published.
0:3914 ATT&CK techniques, from initial access to command and control.
0:454 steps now: Treat any host with a confirmed infostealer as fully compromised.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.