Threat video1:00
SkyW4lker Adobe PDF Device-Code Phishing: Detection & IOCs
An Adobe-hosted PDF lure leads to a device-code OAuth token theft on Microsoft 365. 9 detection rules, 27 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for SkyW4lker Adobe PDF Device-Code Phishing: Detection & IOCs →
Chapters
- 0:00The hookAbout 618 sandbox analyses.
- 0:04The storyKit abuses device codes.
- 0:11Attack pathLures impersonate invoices and contracts.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise21 indicators to hunt: 3 IPs, 13 domains and 3 URLs, and more.
- 0:37MITRE ATT&CK techniques13 ATT&CK techniques, from reconnaissance to collection.
- 0:42Remediation3 steps now: Block or sinkhole the SkyW4lker domains, hostnames and IPs listed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 618 sandbox analyses.
0:05Kit abuses device codes.
0:07Victims type it on Microsoft's page.
0:11Lures impersonate invoices and contracts.
0:14A trusted-platform PDF link leads through a bot-check gate.
0:18Then a device code appears.
0:20Attackers then get a token.
0:25No threat actor is attributed. Confidence: low.
0:3021 indicators to hunt: 3 IPs, 13 domains and 3 URLs, and more.
0:3713 ATT&CK techniques, from reconnaissance to collection.
0:423 steps now: Block or sinkhole the SkyW4lker domains, hostnames and IPs listed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.