Threat video1:00
HAYI / Kataib Hezbollah FaceTime Attacks: Detection & IOCs
Prosecutors say IRGC-backed Kataib Hezbollah directed HAYI arson over FaceTime. Track it with 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for HAYI / Kataib Hezbollah FaceTime Attacks: Detection & IOCs →
Chapters
- 0:00The hookProsecutors say about 18 attacks were directed remotely.
- 0:05The storyFirst, a bomb at a Liege synagogue.
- 0:11Attack pathReportedly, local proxies were recruited and paid.
- 0:28AttributionAttributed to IRGC.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques4 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation3 steps now: Report suspected HAYI recruitment approaches or threats to law enforcement.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Prosecutors say about 18 attacks were directed remotely.
0:05First, a bomb at a Liege synagogue.
0:07Later, arson streamed over FaceTime.
0:11Reportedly, local proxies were recruited and paid.
0:14Arson was allegedly directed live over FaceTime.
0:18Then projected onto a militia logo screen.
0:21Two men were stabbed in Golders Green.
0:23Threadlinqs ships 9 detection rules.
0:28Attributed to IRGC. Confidence: medium.
0:33No malicious indicators were published.
0:394 ATT&CK techniques, from reconnaissance to command and control.
0:433 steps now: Report suspected HAYI recruitment approaches or threats to law enforcement.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.