Threat video1:00
Attack the Glass Runtime Rendering Flaw: Detection & IOCs
A compromised upstream script can alter what users see and capture typed input; 9 detection rules, 23 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Attack the Glass Runtime Rendering Flaw: Detection & IOCs →
Chapters
- 0:00The hook50 platform types: all vulnerable.
- 0:04The storyPolyfill's domain changed hands in 2024.
- 0:11Attack pathAs reported, a firm acquired the domain.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise18 indicators to hunt: 14 domains and 4 URLs.
- 0:35MITRE ATT&CK techniques9 ATT&CK techniques, from resource development to impact.
- 0:40Remediation3 steps now: Inventory every runtime dependency loaded into client-side applications, including fourth-party.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0050 platform types: all vulnerable.
0:05Polyfill's domain changed hands in 2024.
0:08Once loaded, nothing checks it.
0:11As reported, a firm acquired the domain.
0:14Then it ran in visitors' browsers.
0:16Mobile visitors got redirected.
0:19ATG says it could capture input, alter screens.
0:25No threat actor is attributed. Confidence: low.
0:3018 indicators to hunt: 14 domains and 4 URLs.
0:369 ATT&CK techniques, from resource development to impact.
0:413 steps now: Inventory every runtime dependency loaded into client-side applications, including fourth-party.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.