Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
I was recently working on an infostealer infection, the malware logs structure seemed very similar to Lumma. After some non creative googling I found a great report by GenDigital about the new Lumma variant/fork called Remus. Remus log file structure The GenDigital report is fantastic and breaks down the infostealer, how it works, how it’s configured, it’s similarities with Lumma and more, so I won’t go into any details. The tl;dr version is that Remus is a…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://eth.llamarpc.com | High | Score 58/100 | First seen |
| Domain | blablatst12345.net | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…