Threat video1:00
AntiFox IIS Webshells and AWS Key Theft: Detection & IOCs
Self-hosted AntiFox lets attackers plant IIS webshells and harvest AWS secrets. The free Splunk SPL rule leads 9 detection rules and 15 IOCs.
Read the full threat intel for AntiFox IIS Webshells and AWS Key Theft: Detection & IOCs →
Chapters
- 0:00The hookHundreds of AWS calls, about 30 minutes.
- 0:04The storyAttackers ran self-managed AntiFox.
- 0:11Attack pathArctic Wolf reported AntiFox instances.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise7 indicators to hunt: 2 IPs, 3 URLs and 1 SHA-1 hash, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Revoke affected AWS sessions and access keys and rotate any.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Hundreds of AWS calls, about 30 minutes.
0:05Attackers ran self-managed AntiFox.
0:07Then they harvested AWS secrets from IIS.
0:12Arctic Wolf reported AntiFox instances.
0:15They exploited IIS, then deployed a webshell.
0:18Config was staged for retrieval.
0:20They used the secrets on AWS.
0:23Some exposed production secrets.
0:27No threat actor is attributed. Confidence: low.
0:317 indicators to hunt: 2 IPs, 3 URLs and 1 SHA-1 hash, and more.
0:3916 ATT&CK techniques, from resource development to impact.
0:444 steps now: Revoke affected AWS sessions and access keys and rotate any.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.