Threat video1:00
Qilin Ransomware UT Arlington Breach: Detection & IOCs
Qilin claimed the UT Arlington breach: personal data stolen, MachForms offline. Its 9 detection rules, 20 IOCs and a free Splunk SPL rule are ready.
Read the full threat intel for Qilin Ransomware UT Arlington Breach: Detection & IOCs →
Chapters
- 0:00The hookQilin claims a university attack.
- 0:04The storyIn October, hackers stole personal information.
- 0:11Attack pathVendor reports describe Windows shell commands.
- 0:25AttributionAttributed to Qilin.
- 0:29Indicators of compromise13 indicators to hunt: 2 IPs, 3 domains and 3 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Hunt for Qilin affiliate precursors.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Qilin claims a university attack.
0:05In October, hackers stole personal information.
0:08UTA pulled MachForms offline.
0:12Vendor reports describe Windows shell commands.
0:14Then credential dumping, per vendor reporting.
0:17Then Qilin makes a leak-site claim.
0:20No intrusion details have been published.
0:25Attributed to Qilin. Confidence: medium.
0:3013 indicators to hunt: 2 IPs, 3 domains and 3 SHA-256 hashes, and more.
0:3815 ATT&CK techniques, from initial access to impact.
0:434 steps now: Hunt for Qilin affiliate precursors.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.