Threat video1:00
BYOD Ransomware Michigan State Claim: Detection & IOCs
BYOD claims it stole data on 1.3M Michigan State students, and MSU reset NetID passwords. Includes 9 detection rules (one free in Splunk SPL) and 11 IOCs.
Read the full threat intel for BYOD Ransomware Michigan State Claim: Detection & IOCs →
Chapters
- 0:00The hookRansomware gang claims university breach: 1.3 million students.
- 0:05The storyMSU detected credential compromise in October.
- 0:14Attack pathReportedly, credentials were compromised.
- 0:26AttributionAttributed to BYOD.
- 0:31Indicators of compromise1 indicator to hunt: 1 domain.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:42Remediation4 steps now: Force password resets for affected identity populations and revoke active.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ransomware gang claims university breach: 1.3 million students.
0:06MSU detected credential compromise in October.
0:09The gang reported taking one-point-three million records.
0:14Reportedly, credentials were compromised.
0:17Records were then claimed stolen.
0:19MSU listed on the leak site.
0:27Attributed to BYOD. Confidence: low.
0:321 indicator to hunt: 1 domain.
0:377 ATT&CK techniques, from initial access to impact.
0:424 steps now: Force password resets for affected identity populations and revoke active.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.