Threat video1:00
Certified Bad SolarMarker EV Certs: Detection & IOCs
Impostors bought EV certificates by fraud and signed 698 files for 14 families, including SolarMarker: 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for Certified Bad SolarMarker EV Certs: Detection & IOCs →
Chapters
- 0:00The hookOne cert, about 147 days, 14 families.
- 0:05The storyThrough fraud, impostors get EV certs.
- 0:11Attack pathReported, impostors got EV certs, built proof, sold to actors.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise5 indicators to hunt: 5 SHA-256 hashes.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation3 steps now: Hunt for executables signed by the certificates reported.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One cert, about 147 days, 14 families.
0:05Through fraud, impostors get EV certs.
0:08They sell them to malware actors.
0:11Reported, impostors got EV certs, built proof, sold to actors.
0:16They signed 14 malware families with one cert.
0:19Reported but active about 147 days, running remote access attacks.
0:27No threat actor is attributed. Confidence: low.
0:325 indicators to hunt: 5 SHA-256 hashes.
0:386 ATT&CK techniques, from resource development to command and control.
0:433 steps now: Hunt for executables signed by the certificates reported.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.