Threat video1:00
NetSupport RAT via Fake Zillow Pages: Detection & IOCs
Fake Zillow pages trick visitors into running a hidden PowerShell command that drops NetSupport RAT: 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for NetSupport RAT via Fake Zillow Pages: Detection & IOCs →
Chapters
- 0:00The hookFake Zillow pages hid a RAT.
- 0:04The storyIn August, researchers found fake pages.
- 0:11Attack pathFake checks led victims to run a command.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise16 indicators to hunt: 3 IPs, 7 domains and 2 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation10 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake Zillow pages hid a RAT.
0:05In August, researchers found fake pages.
0:08Work laptops were among victims.
0:11Fake checks led victims to run a command.
0:14Next, PowerShell fetched a script.
0:16A legit admin tool became the RAT.
0:19It persisted at login, then called home.
0:24No threat actor is attributed. Confidence: low.
0:2916 indicators to hunt: 3 IPs, 7 domains and 2 SHA-256 hashes, and more.
0:3810 ATT&CK techniques, from resource development to command and control.
0:4410 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.