#detectionsfromthesoc #captcha #infostealer #cryptbot #soc #bec | Hunt & Hackett

Launching #DetectionsFromTheSOC 🚀 We're happy to announce our new series, 𝘋𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯𝘴 𝘧𝘳𝘰𝘮 𝘵𝘩𝘦 𝘚𝘖𝘊, in which we share a behind-the-scenes look of how our SOC detects, investigates, and responds to real-world threats. 𝐅𝐨𝐫 𝐨𝐮𝐫 𝐟𝐢𝐫𝐬𝐭 𝐞𝐝𝐢𝐭𝐢𝐨𝐧: 𝐢𝐧𝐟𝐨𝐬𝐭𝐞𝐚𝐥𝐞𝐫 𝐝𝐞𝐩𝐥𝐨𝐲𝐞𝐝 𝐯𝐢𝐚 𝐟𝐚𝐤𝐞 𝐂𝐚𝐩𝐭𝐜𝐡𝐚  In the middle of the night, Hunt & Hackett’s 24/7 SOC intercepted the early stages of a broader cyberattack. The attacker didn’t break in, but logged in.     An endpoint was compromised using a fake #CAPTCHA page – you know, one of those “I’m not a robot” checks. Only this one tricked the user into running a command via the keyboard shortcut Win + R. That command launched a hidden process and deployed a known #infostealer, likely #Cryptbot.    𝐖𝐡𝐚𝐭 𝐡𝐚𝐩𝐩𝐞𝐧𝐞𝐝?   Our SOC flagged a suspicious mshta.exe process making an outbound connection to a previously unknown domain. This quickly escalated: 👉 User was tricked into copy-pasting a command that secretly launched mshta.exe  👉 mshta.exe triggered PowerShell, which contacted additional anomalous domains and executed fileless malware  👉 PowerShell launched Chrome/Edge with the --remote-debugging-port=9203 flag – a known abuse method to extract browser credentials  👉 The process accessed files in the Downloads folder All signs pointed to credential theft and system reconnaissance.    𝐇𝐨𝐰 𝐰𝐞 𝐝𝐞𝐭𝐞𝐜𝐭𝐞𝐝 𝐢𝐭:   One of our behavioural detection rules flagged:  👉 Use of mshta.exe in user context reaching unknown domains   👉Obfuscated PowerShell activity   👉Abuse of --remote-debugging-port in Chrome – a known credential-stealing tactic  This combination triggered a high-confidence detection, prompting an alert at our #SOC and enabling a fast response & remediation – even at 3AM.    𝐑𝐞𝐦𝐞𝐝𝐢𝐚𝐭𝐢𝐨𝐧:  👉 Clean install of the endpoint  👉 Blocked malicious domains  👉 Revoked all sessions and reset credentials    This case shows how infostealers can be the first step in modern attacks, giving threat actors access to credentials, browser sessions, and local files. From there, they can move laterally, escalate privileges, and pave the way for bigger attacks like ransomware or business email compromise (#BEC) without you knowing it. In short: infostealers are a launchpad for full-scale breaches.    𝐈𝐎𝐂𝐬:  👾 hxxps[:]//afliam[.]shop  👾 b[.]watchcollision[.]xyz  👾 blisspicks[.]shop