Threat video1:00
York University Web Forms Breach: Detection & IOCs
York University web forms exposed submissions back to 2007 across 14 sites. Get 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for York University Web Forms Breach: Detection & IOCs →
Chapters
- 0:00The hookDepartmental online forms breach: 2 indicators.
- 0:05The storyYork states most stolen records are basic.
- 0:13Attack pathReach form submission back ends.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise2 indicators to hunt: 1 domain and 1 URL.
- 0:37MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to collection.
- 0:42Remediation9 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Departmental online forms breach: 2 indicators.
0:05York states most stolen records are basic.
0:08No technical indicators of compromise have been published.
0:13Reach form submission back ends.
0:15Harvest legacy-era form records.
0:18Harvest mid-period form records.
0:26No threat actor is attributed. Confidence: low.
0:312 indicators to hunt: 1 domain and 1 URL.
0:374 ATT&CK techniques, from initial access to collection.
0:429 remediation steps are listed, 4 of them immediate.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.