Challenge
For this challenge, we'll see if we can collect some IOCs for an increasingly common piece of malware – a CoinMiner. Utilizing your own research, attempt to answer the following:
Recently, a security firm (Intezer) identified a Monero-mining campaign utilizing exposed Oracle WebLogic (amongst other vulnerabilities) to install coin-mining software on Linux and Windows machines.
- What file-based IOCs can you identify?
a. What controls would you put in place for a Windows host to prevent this execution?
b. What controls would you put in place for Linux servers?
- What network-based IOCs can you identify?
a. Which is going to be more effective to block? FQDNs or IPs?
b. What controls would you implement for Windows? What about Linux?
