ctrlINT What the industry said about every indicator, with the quote

TOLLBOOTHMalware

  • hijackserver iis

Last reported 9 months ago, by Elastic Security Labs2 reports

ATT&CK techniques

6 of 10 · each with the sentence it comes from
  1. T1003OS Credential Dumping

    “OS Credential Dumping”

    Elastic Security LabsVendor
  2. T1005Data from Local System

    “Data from Local System”

    Elastic Security LabsVendor
  3. T1014Rootkit

    “Threat actors adapted the open source “Hidden” rootkit project to hide their presence”

    Elastic Security LabsVendor
  4. T1036Masquerading

    “This tool piggybacks off the previous Godzilla project by adding new features such as an AMSI bypass plugin and masquerading its network traffic to appear more legitimate.”

    Elastic Security LabsVendor
  5. T1110Brute Force

    “In case it fails to find it with the hardcoded values, it takes a brute-force approach by starting from a hardcoded relative offset to the maximum possible offset.”

    Elastic Security LabsVendor
  6. T1505Server Software Component

    “Server Software Component: IIS Components”

    Elastic Security LabsVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “Take the recent TOLLBOOTH research as an example.”

    Elastic Security LabsVendor
    From Hypothesis to Action: Proactive Threat Hunting with Elastic Security

  2. “TOLLBOOTH: What's yours, IIS mine”

    Elastic Security LabsVendor
    TOLLBOOTH: What's yours, IIS mine

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with TOLLBOOTH here?
No account needed. We do not store your IP address.