Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)
Excerpt
Here is the YARA rule I used to detect " Orphaned VBA Projects Inside DWG Files ". rule autocad_orphaned_vba_project { strings : $a = "AC10" $b = { D0 CF 11 E0 A1 B1 1A E1 } $c = "[Host Extender Info]" ascii condition : $a at 0 and uint32 ( 0x24 ) == 0 and $b and $c } A VirusTotal retrohunt with this rule gave…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 | High | Score 56/100 | First seen |
| SHA256 | 3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…