IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE5 IOCs

Github Ghostpack/safetykatz: Safetykatz is a Combination of Slightly Modified Version of @gentilkiwi's Mimikatz Project and @subtee's .net Pe Loader

OT
ORKL Threat Library
Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREhttp://blog.gentilkiw…against.nethttp://pingcastle.comCAPABILITYMimikatzVICTIMunknown
Adversary
Infrastructure(4)
Capability(1)
Victim

Indicators of Compromise

5 indicators

TypeIndicatorConfidenceScoreFirst Seen
URLhttp://blog.gentilkiwi.com/mimikatzHighScore 67/100First seen
Domainagainst.netHighScore 67/100First seen
URLhttp://pingcastle.comHighScore 67/100First seen
Email[email protected]HighScore 67/100First seen
URLhttp://mysmartlogon.comHighScore 67/100First seen

IOC Relationship Graph

5 total IOCs
URLDomainEmail
URL3Domain1Email1Malware1Github Ghostpack/safetykatz: Safetykatz is a Combination of Slightly Modified Version of @gentilkiwi's Mimikatz Project and @subtee's .net Pe LoaderREPORThttp://blog.gentilki…http://pingcastle.comhttp://mysmartlogon.…against.netbenjamin@gentilkiwi.…Mimikatz
scroll to zoom · drag to pan · click IOC to open