SA -SOC250-212 - APT35 HyperScrape Data Exfiltration Tool Detected скачать в хорошем качестве

SA -SOC250-212 - APT35 HyperScrape Data Exfiltration Tool Detected

Continuing with the Security Analyst Path, we tackle (but not finish) an alert for an "APT35 HyperScrape Data Exfiltration Tool Detected". Was this simply a false positive or possibly something more sinister? ⭐ As of August 2022, APT35 aka Charming Kitten was observed using a new tool called Hyperscrape to extract emails from their victims’ mailboxes EventID : 212 Event Time : Dec, 25, 2023, 11:22 AM Rule : SOC250 - APT35 HyperScrape Data Exfiltration Tool Detected Level : Security Analyst Hostname : Arthur Ip Address : 172.16.17.72 Process Name : EmailDownloader.exe Process Path : C:\Users\LetsDefend\Downloads\EmailDownloader.exe Parent Process : C:\Windows\Explorer.EXE Command Line : C:\Users\LetsDefend\Downloads\EmailDownloader.exe File Hash : cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Trigger Reason : Unusual or suspicious patterns of behavior linked to the hash have been identified, indicating potential malicious intent. Device Action : Allowed Items in question: https://www.virustotal.com/gui/file/c... https://www.hybrid-analysis.com/sampl... https://www.virustotal.com/gui/ip-add... https://talosintelligence.com/reputat... https://otx.alienvault.com/indicator/... https://www.virustotal.com/gui/ip-add... https://talosintelligence.com/reputat... https://otx.alienvault.com/indicator/... NOTES: https://blog.google/threat-analysis-g... https://thehackernews.com/2022/08/goo...