Anvilogic high experimental spl

Known Credential Dumping Tool Execution [splunk-edr]

This Use Case would detect if one of the following tools Mimipenguin, Lazagne or swap_digger is downloaded or executed on a Unix host. -- Threat Actor Association: Alloy Taurus/Gallium, APT15, MuddyWater, TeamTNT - Software Association: ALPHV/BlackCat, AvosLocker, LockBit, Ransom Cartel

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` ("lazagne" 
OR "mimipenguin" 
OR "swap_digger")
| table _time, host, user, process, name, user
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...