Threat video1:00
ScreenConnect Abuse & Infostealer Logins: Detection & IOCs
Elastic's report finds attackers log in 8 minutes after infostealer or ClickFix infections; 9 detection rules, 22 IOCs and a free Splunk SPL rule.
Read the full threat intel for ScreenConnect Abuse & Infostealer Logins: Detection & IOCs →
Chapters
- 0:00The hookLogins follow infection in about 8 minutes.
- 0:04The storyElastic counted 27 infostealer cases.
- 0:11Attack pathA ClickFix lure starts the chain.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise17 indicators to hunt: 1 IP, 5 domains and 1 URL, and more.
- 0:37MITRE ATT&CK techniques20 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation4 steps now: After any infostealer infection, revoke and rotate browser cookies, session.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Logins follow infection in about 8 minutes.
0:05Elastic counted 27 infostealer cases.
0:0812 began with a ClickFix lure.
0:11A ClickFix lure starts the chain.
0:13It escalates privilege and adds a Defender exclusion.
0:17Then ScreenConnect installs silently.
0:20Stolen cookies and logins reach cloud accounts.
0:26No threat actor is attributed. Confidence: low.
0:3017 indicators to hunt: 1 IP, 5 domains and 1 URL, and more.
0:3720 ATT&CK techniques, from initial access to command and control.
0:434 steps now: After any infostealer infection, revoke and rotate browser cookies, session.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.