Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Thruntellisearch Analyst’s Pivot Checklist
Excerpt
TL;DR This is a checklist that thruntellisearch analysts can use in their quest to uncover additional adversary infrastructure. It may help provide a structured analysis. Table of Contents TL;DR Tactical Pause Intro Validators Common Pivots Usage PTA0001 – Domain P0101 – Registration P0101.001 – Registration: Registrar P0101.002 – Registration: Registration date P0101.003 – Registration: Registrant P0101.004 – Registration: Registrant email…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | bmtrck.com | High | Score 58/100 | First seen |
| SHA256 | 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a | Medium | Score 53/100 | First seen |
| SHA256 | 5f3ec643731be3a71b0845e6d398a07ea21dc3c6d0298150470b3b4a1942cf89 | Medium | Score 53/100 | First seen |
| Domain | improvmx.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…