T1134.001 – Token Impersonation/Theft

Blog | Scenario

Nokoyawa
ByDetecteam 2023-09-282023-09-28

TLP TLP TLP CLEAR Author Jordi M. Lobo, David Deflache, Sebastien Tricaud Summary Nokoyawa is a cyber intrusion that began with a malicious Excel document in October 2022. The document triggered macros, leading to the execution of an IcedID DLL payload. The attackers established persistence on the host, deployed Cobalt Strike beacons, escalated privileges, and…

Read More Nokoyawa
Blog | Scenario

SELECT XMRig FROM SQLServer
ByDetecteam 2023-06-092023-06-09

TLP TLP TLP CLEAR Author David Deflache Summary The attack on the Microsoft SQL Server involved a series of sophisticated techniques employed by the adversaries. It began with the initial stage of reconnaissance, where the attackers sought to identify vulnerabilities and potential entry points. They then proceeded to exploit a known vulnerability in the server…

Read More SELECT XMRig FROM SQLServer

End of content

End of content