Threat video1:00
Titan Quest .lvl/.pfx Heap Overflow: Detection & IOCs
Malicious custom maps can run code in Titan Quest through heap overflows in Engine.dll. 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for Titan Quest .lvl/.pfx Heap Overflow: Detection & IOCs →
Chapters
- 0:00The hookShared Titan Quest maps can run attacker code.
- 0:04The storyA researcher disclosed heap overflows.
- 0:11Attack pathCrafted map files trigger the flaw.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise3 indicators to hunt: 1 file name and 2 paths.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from resource development to discovery.
- 0:43Remediation3 steps now: Do not load custom maps, mods, or asset archives.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Shared Titan Quest maps can run attacker code.
0:05A researcher disclosed heap overflows.
0:07No patch is reported.
0:11Crafted map files trigger the flaw.
0:13They spread via modding communities.
0:16A player loads it; the game parses it.
0:18Memory corruption then hijacks control flow.
0:21Code runs with that user's privileges.
0:27No threat actor is attributed. Confidence: low.
0:323 indicators to hunt: 1 file name and 2 paths.
0:388 ATT&CK techniques, from resource development to discovery.
0:433 steps now: Do not load custom maps, mods, or asset archives.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.