Massive eBay Malvertising Attack Fuels Widespread Scams

ID

Data Source

Data Component

Detects

DS0017

Command

Command Execution

Monitor executed commands and arguments that may attempt to take screen captures of the desktop to gather information over the course of an operation.

DS0009

Process

OS API Execution

Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk, such as CopyFromScreen, xwd, or screencapture.[1][2]. The sensor data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.

ID

Data Source

Data Component

Detects

DS0017

Command

Command Execution

Monitor executed commands and arguments for usage of the profiles tool, such as profiles install -type=configuration.

DS0022

File

File Creation

Monitor for newly constructed files and/or all installed extensions maintain a plist file in the /Library/Managed Preferences/username/ directory. Ensure all listed files are in alignment with approved extensions

DS0029

Network Traffic

Network Connection Creation

Monitor for newly constructed network connections that are sent or received by untrusted hosts.

DS0009

Process

Process Creation

Monitor for newly executed processes that could be used to abuse internet browser extensions to establish persistence.

DS0024

Windows Registry

Windows Registry Key Creation

Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation.