Threat video1:00
Agent Tesla RAR and Device Code Phishing: Detection & IOCs
Agent Tesla hides in misleading-extension RAR archives, and QR salary lures abuse device code sign-in: 9 detection rules, 20 IOCs and a free Splunk SPL rule.
Read the full threat intel for Agent Tesla RAR and Device Code Phishing: Detection & IOCs →
Chapters
- 0:00The hookTwo campaigns hit millions.
- 0:04The storyFirst came salary lures.
- 0:10Attack pathQR codes phish device authorization.
- 0:22AttributionNo threat actor is attributed.
- 0:26Indicators of compromise17 indicators to hunt: 3 domains, 1 URL and 5 SHA-256 hashes, and more.
- 0:35MITRE ATT&CK techniques11 ATT&CK techniques, from initial access to lateral movement.
- 0:40Remediation5 steps now: Block and hunt for sender addresses smtp@wekash[.]net and contacto06@carloxmextos[.]org.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Two campaigns hit millions.
0:05First came salary lures.
0:06Then Agent Tesla.
0:10QR codes phish device authorization.
0:13RAR archives, JavaScript downloads Agent Tesla.
0:17Agent Tesla logs keystrokes, harvests credentials.
0:23No threat actor is attributed. Confidence: low.
0:2717 indicators to hunt: 3 domains, 1 URL and 5 SHA-256 hashes, and more.
0:3611 ATT&CK techniques, from initial access to lateral movement.
0:405 steps now: Block and hunt for sender addresses smtp@wekash[.]net and contacto06@carloxmextos[.]org.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.