Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 989855" data-attributes="member: 32260">SWH vs. Yellow Cockatoo (SolarMarker)[URL unfurl=&quot;true&quot;]https://redcanary.com/threat-detection-report/threats/yellow-cockatoo/[/URL][URL unfurl=&quot;true&quot;]https://unit42.paloaltonetworks.com/solarmarker-malware/[/URL]In one of my previous posts, I mentioned that EXE/MSI threats are beyond the scope of SWH - such threats are not fileless malware. But in the case of the recent Yellow Cockatoo attacks, the situation is more complex. It uses EXE/MSI file to execute a benign application (PDF Merge) and malicious Powershell script. SWH blocks PowerShell scripts by default so the attack can be blocked. A similar attack was analyzed in the SWH thread here:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-973934[/URL]On the contrary, the older less advanced Yellow Cockatoo (SolarMarker) attacks did not use fileless methods, so they were beyond the scope of SWH.</blockquote>

[QUOTE="Andy Ful, post: 989855, member: 32260"] [B][SIZE=5]SWH vs. Yellow Cockatoo (SolarMarker)[/SIZE][/B] [URL unfurl="true"]https://redcanary.com/threat-detection-report/threats/yellow-cockatoo/[/URL] [URL unfurl="true"]https://unit42.paloaltonetworks.com/solarmarker-malware/[/URL] In one of my previous posts, I mentioned that EXE/MSI threats are beyond the scope of SWH - such threats are not fileless malware. But in the case of the recent Yellow Cockatoo attacks, the situation is more complex. It uses EXE/MSI file to execute a benign application (PDF Merge) and malicious Powershell script. [B][COLOR=rgb(0, 168, 133)]SWH blocks PowerShell scripts by default so the attack can be blocked. [/COLOR][/B]A similar attack was analyzed in the SWH thread here: [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-973934[/URL] On the contrary, the older less advanced Yellow Cockatoo (SolarMarker) attacks did not use fileless methods, so they were beyond the scope of SWH. [/QUOTE]

Verification