TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

SANS ISC Diaries

Danger of Libredtail [Guest Diary], (Wed, Apr 29th)

6 days ago · Read original ↗

ATT&CK techniques detected

6 predictions
T1588.006Vulnerabilities
89%
“analysis / 1893948 / 0 / html [ 9 ] https : / / www. socdefenders. ai / threats / b91c3aa2 - d17d - 4621 - 8f76 - 99e3226bdecb [ 10 ] https : / / nvd. nist. gov / vuln / detail / cve - 2024 - 4577 [ 11 ] https : / / www. forescout. com / blog / new - redtail - malware - exploited…”
T1190Exploit Public-Facing Application
86%
“##7. selfrep as a different script. additionally, echo ( md5 ( " hello cve - 2024 - 4577 " ) is also run to print a message to indicate the previous commands have run correctly. like the other post actions, the original query was encoded in base64. next the attack begins probing …”
T1190Exploit Public-Facing Application
84%
“commands. the logins and port scans typically hours before or after the http actions and are likely the bot engaging in those probing actions independently from anything related in http. the syn scans consistently produced failures for the scanned ports. from ip 2. 27. 53. 96 tim…”
T1059.006Python
71%
“exploit strongly associated with redtail malware that targets php services. the request body line ” : d + allow _ url _ include = 1 + d + auto _ prepend _ file = php : / / input ” takes advantage of older php versions flaw of replacing certain characters given into something else…”
T1190Exploit Public-Facing Application
42%
“exploit strongly associated with redtail malware that targets php services. the request body line ” : d + allow _ url _ include = 1 + d + auto _ prepend _ file = php : / / input ” takes advantage of older php versions flaw of replacing certain characters given into something else…”
T1587.004Exploits
41%
“analysis / 1893948 / 0 / html [ 9 ] https : / / www. socdefenders. ai / threats / b91c3aa2 - d17d - 4621 - 8f76 - 99e3226bdecb [ 10 ] https : / / nvd. nist. gov / vuln / detail / cve - 2024 - 4577 [ 11 ] https : / / www. forescout. com / blog / new - redtail - malware - exploited…”

Summary

[This is a Guest Diary by James Roberts, an ISC intern as part of the SANS.edu BACS program]