Threat hunts for MikroTik
2 hunts covering MikroTik, each with a hypothesis, the queries that test it and what the hunt cannot see.
2 hunts
-
high Part 2 of 2Research by Sekoia
APT28 Edge Hijacking and AI-Driven Exfiltration
An adversary has hijacked local DNS settings via compromised edge infrastructure and is using a rare, non-browser process to automate the harvesting of documents for exfiltration via AI APIs or high-port tunnels.
3 query1 analytic1 checkpoint1 action2 taskCVE-2022-38028 · CVE-2023-23397 -
high Part 1 of 2Research by Sekoia
APT28: Outlook and Print Spooler Exploitation
An adversary is exploiting unpatched Outlook or Print Spooler vulnerabilities to harvest NTLM credentials or escalate privileges, evidenced by outbound SMB connections to external IPs and rare child processes launched by the spooler service.
4 query2 analytic2 checkpoint1 action2 taskCVE-2022-38028 · CVE-2023-23397