UNC4841-Barracuda-ESG-Zero-Day-Exploitation

UNC4841 - Barracuda ESG Exploitation Indicators

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

UNC4841 - Download Compressed Files From Temp.sh Using Wget

Aug 12, 2024 · attack.defense-evasion attack.t1140 detection.emerging-threats ·

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

UNC4841 - Download Tar File From Untrusted Direct IP Via Wget

Aug 12, 2024 · attack.defense-evasion attack.t1140 detection.emerging-threats ·

Share on:

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

UNC4841 - Email Exfiltration File Pattern

Aug 12, 2024 · attack.execution attack.persistence attack.defense-evasion detection.emerging-threats ·

Share on:

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

UNC4841 - Potential SEASPY Execution

Aug 12, 2024 · attack.execution detection.emerging-threats ·

Share on:

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

UNC4841 - SSL Certificate Exfiltration Via Openssl

Aug 12, 2024 · attack.defense-evasion attack.t1140 detection.emerging-threats ·

Share on:

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.