Threat video1:00
Qilin RaaS Admin Haise Linked by Krebs: Detection & IOCs
Krebs on Security links the Qilin RaaS admin to the handle Haise. Track it with 9 detection rules, 21 IOCs and a free Splunk SPL rule.
Read the full threat intel for Qilin RaaS Admin Haise Linked by Krebs: Detection & IOCs →
Chapters
- 0:00The hookQilin ranked most active ransomware group.
- 0:04The storyKrebs links the administrator to older handles.
- 0:10Attack pathPer Talos, leaked admin credentials gave initial access.
- 0:27AttributionAttributed to Qilin.
- 0:32Indicators of compromise9 indicators to hunt: 6 file names, 2 registry keys and 1 path.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Enforce MFA on all VPN and remote-access services and reset.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Qilin ranked most active ransomware group.
0:05Krebs links the administrator to older handles.
0:08The subject did not respond.
0:11Per Talos, leaked admin credentials gave initial access.
0:15A VPN login without MFA, then domain discovery.
0:19Then endpoint security tooling was disabled.
0:22Data was stolen, then systems were encrypted.
0:27Attributed to Qilin. Confidence: medium.
0:329 indicators to hunt: 6 file names, 2 registry keys and 1 path.
0:3917 ATT&CK techniques, from initial access to impact.
0:434 steps now: Enforce MFA on all VPN and remote-access services and reset.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.