Actor
high
threat
TrickBot Variant Utilizes DNS Tunneling for Command and Control
4 TTPsFortiGuard Labs analyzed a new TrickBot variant that employs DNS tunneling for command and control communications, modular execution, and incorporates persistence and obfuscation techniques to evade detection and maintain presence on infected systems.
TrickBot
malware
banking-trojan
dns-tunneling
c2
persistence
obfuscation
4t
low
threat
AdFind Active Directory Reconnaissance Activity
3 rules 5 TTPsAdFind.exe, a legitimate Active Directory query tool, is commonly abused by threat actors such as Trickbot, Ryuk, Maze, and FIN6 for post-exploitation Active Directory reconnaissance, enabling enumeration of objects like computers, people, subnets, and domain information.
Active Directory
Trickbot
+3
adfind
active-directory
reconnaissance
discovery
windows
3r
5t