Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Introducing the Adversary Playbook: First up, Oil Rig

Summary: Unit 42 introduced an Adversary Playbook format that organizes an adversary's tools, techniques, and procedures using STIX 2.0 and MITRE's ATT&CK framework, and released its first entry covering the OilRig threat group. The OilRig Playbook contains data on three campaigns from May 2016 to September 2017, with 123 indicators mapped to 19 ATT&CK techniques, and Unit 42 also released a web viewer for the STIX JSON.

Why it matters: OilRig targets organizations primarily in the Middle East, carries out supply chain attacks, and relies on stolen credentials and tools like Mimikatz for lateral movement rather than software exploits - so defenses tuned to vulnerability patching alone would miss this group's primary path.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related