Threat video1:00
Gh0st RAT and XMRig on SQL Servers: Detection & IOCs
Brute-forced SQL logins lead to xp_cmdshell, a Themida-protected Gh0st RAT and an XMRig miner: 31 IOCs, 9 detection rules, a free Splunk SPL rule.
Read the full threat intel for Gh0st RAT and XMRig on SQL Servers: Detection & IOCs →
Chapters
- 0:00The hookSQL Server malware: 29 indicators.
- 0:04The storyNo threat actor is named.
- 0:11Attack pathScan for open MSSQL hosts.
- 0:23AttributionNo threat actor is attributed.
- 0:27Indicators of compromise29 indicators to hunt: 6 domains, 8 URLs and 13 SHA-256 hashes, and more.
- 0:37MITRE ATT&CK techniques22 ATT&CK techniques, from initial access to impact.
- 0:42Remediation5 steps now: Block outbound traffic to vietnam852[.]com, swordaa[.]com.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00SQL Server malware: 29 indicators.
0:05No threat actor is named.
0:11Scan for open MSSQL hosts.
0:14Launch brute-forcer on open hosts.
0:23No threat actor is attributed. Confidence: low.
0:2829 indicators to hunt: 6 domains, 8 URLs and 13 SHA-256 hashes, and more.
0:3722 ATT&CK techniques, from initial access to impact.
0:425 steps now: Block outbound traffic to vietnam852[.]com, swordaa[.]com.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.