Threat video1:00
Falcon Extortion Buchanan Ingersoll Leak: Detection & IOCs
Falcon, a UNC6671 extortion brand, claims ~260 GB from Buchanan Ingersoll & Rooney. Its 9 detection rules and 24 IOCs include a free Splunk SPL rule.
Read the full threat intel for Falcon Extortion Buchanan Ingersoll Leak: Detection & IOCs →
Chapters
- 0:00The hookLaw firm falls to Falcon extortion.
- 0:04The storyPasskey phishing took credentials.
- 0:11Attack pathPhishing passkey domains stole sessions.
- 0:24AttributionAttributed to Falcon.
- 0:29Indicators of compromise17 indicators to hunt: 7 IPs and 10 domains.
- 0:34MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to impact.
- 0:40Remediation6 steps now: Hunt Microsoft 365 for FileAccessed/FileDownloaded bursts and scripting user agents.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Law firm falls to Falcon extortion.
0:05Passkey phishing took credentials.
0:07Then attackers stormed the cloud.
0:11Phishing passkey domains stole sessions.
0:14Attacker enrolled MFA, deleted alerts.
0:17Exfiltrated 260 GB legal data cloud.
0:24Attributed to Falcon. Confidence: medium.
0:2917 indicators to hunt: 7 IPs and 10 domains.
0:3516 ATT&CK techniques, from resource development to impact.
0:406 steps now: Hunt Microsoft 365 for FileAccessed/FileDownloaded bursts and scripting user agents.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.