Threat video1:00
GHSA-632h-h47v-g4x4 OpenCode RCE: Detection & IOCs
A malicious webpage can make OpenCode's local server install an attacker's npm package: 9 detection rules, 6 IOCs and a free Splunk SPL rule.
Read the full threat intel for GHSA-632h-h47v-g4x4 OpenCode RCE: Detection & IOCs →
Chapters
- 0:00The hookAbout 647,000 vulnerable npm downloads.
- 0:05The storyShipped in April, fixed in August.
- 0:11Attack pathDatadog reported three chained weaknesses.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise4 indicators to hunt: 1 IP, 1 SHA-1 hash and 1 package name, and more.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from resource development to execution.
- 0:43Remediation9 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 647,000 vulnerable npm downloads.
0:06Shipped in April, fixed in August.
0:08Public proof of concept in September.
0:12Datadog reported three chained weaknesses.
0:14Web pages can reach the local server.
0:17With no password, a target goes unchecked.
0:20npm fetches a remote tarball.
0:22Preinstall script runs code.
0:27No threat actor: this was defensive research.
0:314 indicators to hunt: 1 IP, 1 SHA-1 hash and 1 package name, and more.
0:395 ATT&CK techniques, from resource development to execution.
0:449 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.