Threat video1:00
RIG, Spelevo, PurpleFox Exploit Kits: Detection & IOCs
Six exploit kits still deliver drive-by attacks to Internet Explorer users via five CVEs, with 9 detection rules, 25 IOCs and a free Splunk SPL rule.
Read the full threat intel for RIG, Spelevo, PurpleFox Exploit Kits: Detection & IOCs →
Chapters
- 0:00The hookSix exploit kits remain still active.
- 0:04The storyThey exploit IE with drive-by downloads.
- 0:10Attack pathMalvertising lands an IE exploit.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise11 indicators to hunt: 1 IP, 6 domains and 4 SHA-256 hashes.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Apply the Microsoft cumulative updates fixing.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Six exploit kits remain still active.
0:05They exploit IE with drive-by downloads.
0:07They deliver banking trojans.
0:11Malvertising lands an IE exploit.
0:13PowerShell downloads the main component.
0:16Rootkit hides the malware.
0:18Tor handles command and control.
0:20Capturing banking credentials.
0:25No threat actor is attributed. Confidence: low.
0:3011 indicators to hunt: 1 IP, 6 domains and 4 SHA-256 hashes.
0:3813 ATT&CK techniques, from resource development to command and control.
0:444 steps now: Apply the Microsoft cumulative updates fixing.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.