Zinc Actor IOCs files - October 2022

Identifies a match across filename and commandline IOC's related to an actor tracked by Microsoft as Zinc. Reference: https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/

Detection logic

Detection requirements

Platform: IaaS Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: microsoftthreatprotection securityevents windowssecurityevents
Log source service: deviceevents devicefileevents devicenetworkevents deviceprocessevents securityevent securityevents

Detection rules

Zinc Actor IOCs files - October 2022

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules