Threat video1:00
Gh0st RAT and XMRig via T-SQL on MS SQL: Detection & IOCs
T-SQL enables xp_cmdshell on MS SQL, then drops a Gh0st RAT loader and XMRig miner. Respond with 9 detection rules, 43 IOCs and a free Splunk SPL rule.
Read the full threat intel for Gh0st RAT and XMRig via T-SQL on MS SQL: Detection & IOCs →
Chapters
- 0:00The hookMalware came through weak SQL logins.
- 0:04The storyA scanner hunted exposed SQL servers.
- 0:10Attack pathA T-SQL script enabled command execution.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise38 indicators to hunt: 7 domains, 14 URLs and 13 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques22 ATT&CK techniques, from execution to impact.
- 0:43Remediation4 steps now: Block the campaign domains and associated URLs at the perimeter.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Malware came through weak SQL logins.
0:05A scanner hunted exposed SQL servers.
0:08Guessed logins let them in.
0:11A T-SQL script enabled command execution.
0:14A loader fetched files and profiled hosts.
0:17Scheduled tasks kept them running.
0:19An XMRig miner and a Gh0st RAT followed.
0:25No threat actor is attributed. Confidence: low.
0:3038 indicators to hunt: 7 domains, 14 URLs and 13 SHA-256 hashes, and more.
0:3922 ATT&CK techniques, from execution to impact.
0:444 steps now: Block the campaign domains and associated URLs at the perimeter.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.