Chapter 9 – The Reverse Card – Weaponization of IOCs and OSINT for Defense

In this chapter, we talked about weaponizing IOCs and turning the tables on attackers by preventing their malware from executing at all – or limiting its ability to communicate with those that control it. You were tasked with collecting IOCs via OSINT about a Monero coin-mining campaign and implementing strategies to mitigate it within your environment:

1. The file hashes you should have been able to gain are 240fe01d9fcce5aae311e906b8 311a1975f8c1431b83618f3d11aeaff10aede3 and 8ecffbd4a0c3709cc98b036a895289f3 3b7a8650d7b000107bafd5bd0cb04db3.

   a. The best mitigations for Windows servers would be to block the initial PowerShell command utilized to download and execute the installer for the XMRig binary – some research on the internet should have led you to the command being utilized. For further reading on the threat and the solutions you should have come to, please see the following...