Threat video1:00
XZ Utils and Axios npm SBOM Gaps: Analysis & Hunting
The XZ Utils and Axios npm cases show where SBOMs fail: 9 detection rules, 29 IOCs and a free Splunk SPL rule across 18 ATT&CK techniques.
Read the full threat intel for XZ Utils and Axios npm SBOM Gaps: Analysis & Hunting →
Chapters
- 0:00The hookSBOMs fall short against supply attacks.
- 0:04The storyXZ Utils introduced a backdoor.
- 0:10Attack pathA clean decoy package was published first.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise27 indicators to hunt: 1 IP, 2 domains and 3 URLs, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation4 steps now: Search package-lock.json, yarn[.]lock and bun[.]lock for axios.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00SBOMs fall short against supply attacks.
0:05XZ Utils introduced a backdoor.
0:07Then Axios's account was hijacked.
0:11A clean decoy package was published first.
0:13Then malicious plain-crypto-js and trojanized axios.
0:18Trend Micro and Snyk documented the RAT.
0:21npm removed both malicious versions.
0:27No threat actor is attributed. Confidence: low.
0:3127 indicators to hunt: 1 IP, 2 domains and 3 URLs, and more.
0:3818 ATT&CK techniques, from resource development to command and control.
0:444 steps now: Search package-lock.json, yarn[.]lock and bun[.]lock for axios.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.