Threat video1:00
SolarMarker Impostor Code-Signing Certs: Detection & IOCs
SolarMarker signs malware with impostor business certificates; 9 detection rules, 21 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for SolarMarker Impostor Code-Signing Certs: Detection & IOCs →
Chapters
- 0:00The hookAbout 100 certificates signed their malware.
- 0:04The storyShell companies registered, certificates obtained.
- 0:11Attack pathSelected businesses to impersonate, obtained certificates.
- 0:25AttributionAttributed to SolarMarker operators.
- 0:30Indicators of compromise15 indicators to hunt: 10 IPs, 4 SHA-256 hashes and 1 path.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Report abused code-signing certificates to the issuing certificate authority.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 100 certificates signed their malware.
0:05Shell companies registered, certificates obtained.
0:08Each signed malware deployed weekly.
0:11Selected businesses to impersonate, obtained certificates.
0:15Signed malware, replaced certificates.
0:17Victims downloaded, executed malware.
0:20Campaign lasted three years, paused.
0:25Attributed to SolarMarker operators. Confidence: low.
0:3015 indicators to hunt: 10 IPs, 4 SHA-256 hashes and 1 path.
0:3812 ATT&CK techniques, from resource development to command and control.
0:444 steps now: Report abused code-signing certificates to the issuing certificate authority.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.