Threat video1:00
Qlik Sense Go Backdoor and Veeam Staging: Detection & IOCs
Cynet blocked PowerShell reverse shells aimed at EU Qlik Sense servers. Track it with 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for Qlik Sense Go Backdoor and Veeam Staging: Detection & IOCs →
Chapters
- 0:00The hookQlik Sense targeted within about 3 minutes.
- 0:04The storyIn October, Cynet blocked attempts on EU Qlik servers.
- 0:11Attack pathPer Cynet, the initial access is unknown.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise8 indicators to hunt: 1 IP, 3 URLs and 3 file names, and more.
- 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation12 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Qlik Sense targeted within about 3 minutes.
0:05In October, Cynet blocked attempts on EU Qlik servers.
0:09Staging server exposed.
0:12Per Cynet, the initial access is unknown.
0:15PowerShell tooling delivered a Go backdoor.
0:17A persistence variant installed sshd and a WinUpdCheck task.
0:22Cynet assesses broader attacks may be staged.
0:28No threat actor is attributed. Confidence: low.
0:328 indicators to hunt: 1 IP, 3 URLs and 3 file names, and more.
0:3911 ATT&CK techniques, from initial access to command and control.
0:4412 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.