Threat video1:00
School Bomb Threat Emails: Detection & IOCs
Reported sender addresses appear in infostealer data, though misuse is unproven. Hunt with 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for School Bomb Threat Emails: Detection & IOCs →
Chapters
- 0:00The hookAbout 6,000 Italian schools received hoax bomb threats.
- 0:05The storyTwo sender addresses appear in infostealer data.
- 0:11Attack pathA 2021 Vidar log held 112 Chrome passwords.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise2 indicators to hunt: 2 URLs.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from resource development to collection.
- 0:43Remediation4 steps now: Reset passwords for any account verified in infostealer data.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 6,000 Italian schools received hoax bomb threats.
0:05Two sender addresses appear in infostealer data.
0:08No proof credentials sent the threats.
0:12A 2021 Vidar log held 112 Chrome passwords.
0:16A Taiwanese address matched a stealer-log entry.
0:20Either credential set could supply a sender account.
0:23A university says an alumnus account appeared compromised.
0:29No threat actor is attributed. Confidence: low.
0:342 indicators to hunt: 2 URLs.
0:394 ATT&CK techniques, from resource development to collection.
0:444 steps now: Reset passwords for any account verified in infostealer data.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.