Sunturai
Threat report

www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs

https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Published on
www.microsoft.com
Sources in this catalogue
2

ATT&CK techniques those detections carry

  • T1105Ingress Tool Transfer
  • T1197BITS Jobs
  • T1564.004NTFS File Attributes
  • T1027Obfuscated Files or Information
  • T1036.003Rename Legitimate Utilities
  • T1059Command and Scripting Interpreter
  • T1190Exploit Public-Facing Application
  • T1202Indirect Command Execution
Open the original

10 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Cisco NVM - Webserver Download From File Sharing WebsiteMedium
Cisco NVM - Suspicious Download From File Sharing WebsiteInformational
Suspicious File Download From File Sharing Domain Via Wget.EXEHigh
Renamed NirCmd.EXE ExecutionHigh
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXEHigh
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXEHigh
Suspicious Download From File-Sharing Website Via BitsadminHigh
Unusual File Download From File Sharing Websites - File StreamMedium
Suspicious File Download From File Sharing Websites - File StreamHigh
BITS Transfer Job Download From File Sharing DomainsHigh

Showing 10 of 10

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice