mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
tccontre
24 lines
1.1 KiB
YAML
24 lines
1.1 KiB
YAML
name: AcidRain
|
|
id: c68717c6-4938-434b-987c-e1ce9d516124
|
|
version: 1
|
|
date: '2022-04-12'
|
|
author: Teoderick Contreras, Splunk
|
|
description: Leverage searches that allow you to detect and investigate unusual activities
|
|
that might relate to the acidrain malware including deleting of files and etc.
|
|
AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers.
|
|
The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target.
|
|
This malware is capable of wiping and deleting non-standard linux files and overwriting storage device files that might related to router, ssd card and many more.
|
|
narrative: Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption
|
|
is the goal.
|
|
references:
|
|
- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
|
|
tags:
|
|
analytic_story: AcidRain
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|