Threat video1:00
SnakeKeylogger Fake Quote-Request Emails: Detection & IOCs
SnakeKeylogger arrives in quote-review emails and hollows aspnet_compiler.exe to log keystrokes. Includes 9 detection rules, 13 IOCs, a free Splunk SPL rule.
Read the full threat intel for SnakeKeylogger Fake Quote-Request Emails: Detection & IOCs →
Chapters
- 0:00The hookA quote request delivered an infostealer.
- 0:04The storyA purchasing email carried JavaScript.
- 0:10Attack pathReportedly, the recipient opens the archive.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise10 indicators to hunt: 4 domains, 1 MD5 hash and 2 file names, and more.
- 0:39MITRE ATT&CK techniques14 ATT&CK techniques, from initial access to exfiltration.
- 0:44Remediation4 steps now: Block and search mail logs for the lure.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A quote request delivered an infostealer.
0:05A purchasing email carried JavaScript.
0:07Then it hid inside a Microsoft tool.
0:10Reportedly, the recipient opens the archive.
0:13Then obfuscated PowerShell decrypts another stage.
0:17A loader hollows a Microsoft tool.
0:19It steals browser credentials and system details.
0:23It sends data out over SMTP.
0:28No threat actor is attributed. Confidence: low.
0:3210 indicators to hunt: 4 domains, 1 MD5 hash and 2 file names, and more.
0:3914 ATT&CK techniques, from initial access to exfiltration.
0:444 steps now: Block and search mail logs for the lure.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.