Marco Moran
@MarcoMHong KongCompletionist
0 followers16 downloads311 copies2 likes607 views
23 detections
Filters
Last updated
All Time
Detection languages
23
Categories
1
1
Platforms
2
1
Products / Services
1
MITRE Techniques
1
1
CVEs
4
4
2
2
2
The detection rule specifically looks for Windows Security Event ID 5145, which indicates a network share access, where the ShareName starts with '\\' and ends with '\IPC$', the RelativeTargetName is 'lsarpc', and the SubjectUserName is 'ANONYMOUS LOGON'. This combination of events is indicative of a PetitPotam attack attempting to force a domain controller to authenticate to a malicious server.
The detection identifies successful NTLM V2 logons (Event ID 4624) that received an elevated token while not having a source workstation name. This combination is uncommon during normal user activity and may indicate authentication coercion techniques such as PetitPotam, NTLM relay activity, or service-to-service authentication originating from an unexpected host.
Attackers are distributing malware disguised as a legitimate KakaoTalk installer. The campaign leverages the popularity of KakaoTalk to trick users into downloading a trusted application but instead installs the Winos4.0 malware.
Once executed, the malware operates under the guise of KakaoTalk, making it harder for users to recognize the infection. It can steal information, manipulate system processes, and download additional malicious payloads. The threat primarily targets users who obtain KakaoTalk from unofficial sources, which increases the risk of compromise.
Once executed, the malware operates under the guise of KakaoTalk, making it harder for users to recognize the infection. It can steal information, manipulate system processes, and download additional malicious payloads. The threat primarily targets users who obtain KakaoTalk from unofficial sources, which increases the risk of compromise.
Page 3 of 3