Threat video1:00
Able2Shell N-able RMM Abuse: Detection & IOCs
Able2Shell chains let attackers hide in MeshAgent and ScreenConnect traffic. Hunt it with 9 detection rules, 30 IOCs and a free Splunk SPL rule.
Read the full threat intel for Abuse of legitimate RMM and remote access tools (MeshAgent… →
Chapters
- 0:00The hookAttackers hide in approved remote tools.
- 0:04The storyA compromised MSP exposes many customers.
- 0:11Attack pathAcronis reports trojanized ScreenConnect installers.
- 0:27AttributionAttributed to Andariel.
- 0:31Indicators of compromise24 indicators to hunt: 8 IPs, 5 domains and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques19 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation6 steps now: Inventory all remote access and RMM tools on every endpoint.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Attackers hide in approved remote tools.
0:05A compromised MSP exposes many customers.
0:08It generated hundreds of incidents.
0:11Acronis reports trojanized ScreenConnect installers.
0:15Victims run it and join the attacker's ScreenConnect.
0:18AsyncRAT and PureHVNC follow over two months.
0:23Then RDP extends access.
0:27Attributed to Andariel. Confidence: low.
0:3224 indicators to hunt: 8 IPs, 5 domains and 2 URLs, and more.
0:3819 ATT&CK techniques, from initial access to command and control.
0:446 steps now: Inventory all remote access and RMM tools on every endpoint.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.