Anvilogic high experimental other

Known Credential Dumping Tool Execution [snowflake-crowdstrikefdr_process]

This Use Case would detect if one of the following tools Mimipenguin, Lazagne or swap_digger is downloaded or executed on a Unix host. -- Threat Actor Association: Alloy Taurus/Gallium, APT15, MuddyWater, TeamTNT - Software Association: ALPHV/BlackCat, AvosLocker, LockBit, Ransom Cartel

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Lin' or event_platform = 'Mac') and (process ilike '%lazagne%' or process ilike '%mimipenguin%' or process ilike '%swap_digger%')

Field Validations

Loading…

Comments (0)

Loading comments...