Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 989799" data-attributes="member: 32260">Some of the threats noted in Red Canary’s 2022 Threat Detection Report are penetration tools/frameworks used in the already compromised environment. They are used in highly targeted attacks (mostly in lateral movement), so I skipped them in the SWH thread.The rest of the most prevalent threats: TA551, Qbot (Quakbot), SocGholish, Yellow Cockatoo (SolarMarker), and Gootkit (Gootloader) could be reused in the attacks against home users. <s>The Yellow Cockatoo threat uses EXE/MSI files as an initial infection vector so it is beyond the scope of SWH. </s> The Yellow Cockatoo (SolarMarker) uses EXE/MSI files. The older versions were not fileless, so they were beyond the scope of SWH. The recent versions described in the RedCanary Report use also EXE/MSI files, but the malicious actions are performed by the PowerShell script, so the malware is blocked by SWH (default settings).Other threats were already analyzed and all of them could be blocked by older versions of SWH (default settings) + Defender / ConfigureDefender HIGH settings. The new versions of SWH (ver. 1.1.1.1 and later) can block these threats by the recommended settings in SWH (even without ConfigureDefender).&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Post edited.</blockquote>

[QUOTE="Andy Ful, post: 989799, member: 32260"] Some of the threats noted in Red Canary’s 2022 Threat Detection Report are penetration tools/frameworks used in the already compromised environment. They are used in highly targeted attacks (mostly in lateral movement), so I skipped them in the SWH thread. The rest of the most prevalent threats: TA551, Qbot (Quakbot), SocGholish, Yellow Cockatoo (SolarMarker), and Gootkit (Gootloader) could be reused in the attacks against home users. [S]The Yellow Cockatoo threat uses EXE/MSI files as an initial infection vector so it is beyond the scope of SWH. [/S] The Yellow Cockatoo (SolarMarker) uses EXE/MSI files. The older versions were not fileless, so they were beyond the scope of SWH. The recent versions described in the RedCanary Report use also EXE/MSI files, but the malicious actions are performed by the PowerShell script, so the malware is blocked by SWH (default settings). Other threats were already analyzed and all of them could be blocked by older versions of SWH (default settings) + Defender / ConfigureDefender HIGH settings. The new versions of SWH (ver. 1.1.1.1 and later) can block these threats by the recommended settings in SWH (even without ConfigureDefender). :)(y) Post edited. [/QUOTE]

Verification