Threat video1:00
Abe Office RAT Defeats Chrome Encryption: Detection & IOCs
Abe Office runs a hidden-desktop browser that asks Chrome's elevation service for the key. Its 20 IOCs and 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for Abe Office RAT Defeats Chrome Encryption: Detection & IOCs →
Chapters
- 0:00The hookA fake helper collects browser passwords.
- 0:04The storyIn sandboxes, operators reached saved-password pages.
- 0:11Attack pathKit staged on operator servers.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise18 indicators to hunt: 2 IPs, 2 URLs and 7 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques30 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Block outbound TCP 9090 and all traffic.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A fake helper collects browser passwords.
0:05In sandboxes, operators reached saved-password pages.
0:08Rogue Authority published it.
0:12Kit staged on operator servers.
0:14Disguised as a helper, it persists.
0:16The server gates the add-ons.
0:18Then it steals passwords and cookies.
0:24No threat actor is attributed. Confidence: low.
0:2918 indicators to hunt: 2 IPs, 2 URLs and 7 SHA-256 hashes, and more.
0:3830 ATT&CK techniques, from resource development to impact.
0:434 steps now: Block outbound TCP 9090 and all traffic.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.