xzbotMalware
- xzorcist
A backdoor brought into version 5.6.0 and 5.6.1 of compression library/tool xz/liblzma, which was intended to enable access via (Open)SSH on affected servers.From MISP Galaxy
Last reported 8 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1003OS Credential Dumping
“Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”
- T1003.001LSASS Memory
“You run Impacket's secretsdump to pull hashes from the SAM database and LSASS memory.”
- T1003.002Security Account Manager
“Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”
- T1003.006DCSync
“Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”
- T1036Masquerading
“Process Path and Hash: The full file path helps identify masquerading (e.g., svchost.exe running from C\:Temp instead of C:\Windows\System32).”
- T1053.005Scheduled Task
“Persistence | T1053.005 (Scheduled Task) | A scheduled task was created | Event ID 4698 or schtasks.exe /create.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Automating GOAD and Live Malware Labs“Tool: xzbot”
Indicators in its reports
named in the reports above- hxxps://github[.]com/elastic/detection-rulesin 1 report
Copy this indicator · defanged
Thanks — we review every report.