Sunturai
Threat report

blog.talosintelligence.com/2022/09/lazarus-three-rats.html

http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Published on
blog.talosintelligence.com
Sources in this catalogue
2

ATT&CK techniques those detections carry

  • T1033System Owner/User Discovery
  • T1048Exfiltration Over Alternative Protocol
  • T1053.005Scheduled Task
  • T1087Account Discovery
  • T1112Modify Registry
  • T1127Trusted Developer Utilities Proxy Execution
  • T1552Unsecured Credentials
  • T1654Log Enumeration
Open the original

10 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Windows EventLog Recon Activity Using Log Query UtilitiesInformational
Winlogon AllowMultipleTSSessions EnableMedium
Suspicious Redirection to Local Admin ShareHigh
Potentially Suspicious EventLog Recon Activity Using Log Query UtilitiesMedium
Suspicious Schtasks Schedule TypesHigh
User Discovery And Export Via Get-ADUser CmdletMedium
Computer Discovery And Export Via Get-ADComputer CmdletMedium
Potential Arbitrary Code Execution Via Node.EXEHigh
User Discovery And Export Via Get-ADUser Cmdlet - PowerShellMedium
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShellMedium

Showing 10 of 10

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice