Threat video1:00
Praetorian Brutus Adds 14 Protocols: Analysis & Hunting
Praetorian's Brutus now tests 14 new protocols and keeps confirmed credentials across runs. It ships 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for Praetorian Brutus Adds 14 Protocols: Analysis & Hunting →
Chapters
- 0:00The hookBrutus expands to 14 new protocols.
- 0:04The storyFebruary: Praetorian released Brutus.
- 0:11Attack pathAttacker discovers services and enumerates identities.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise6 indicators to hunt: 1 domain, 1 URL and 3 file names, and more.
- 0:37MITRE ATT&CK techniques15 ATT&CK techniques, from reconnaissance to command and control.
- 0:42Remediation3 steps now: Change default and vendor-shipped credentials on message brokers, caches, databases.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Brutus expands to 14 new protocols.
0:05February: Praetorian released Brutus.
0:07September brought 14 new protocols.
0:11Attacker discovers services and enumerates identities.
0:15Tests credentials across all protocols.
0:17Persists confirmed credentials, tests for reuse.
0:21Uses credentials, probes RDP for backdoors.
0:27No threat actor is attributed. Confidence: low.
0:316 indicators to hunt: 1 domain, 1 URL and 3 file names, and more.
0:3815 ATT&CK techniques, from reconnaissance to command and control.
0:433 steps now: Change default and vendor-shipped credentials on message brokers, caches, databases.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.