Skip to content
Threat Feed
Subscribe

Tag

Fin7

4 briefs RSS
high threat

Halfbaked Malware Command and Control Beaconing Detected

FIN7 is leveraging Halfbaked malware to establish persistence and conduct command and control (C2) operations within compromised networks, using HTTP and TLS protocols with specific URL structures (e.g., `http://[IP_ADDRESS]/cd`) and common ports (53, 80, 8080, 443) for detection evasion and data exfiltration.

FIN7 +2 command-and-control malware halfbaked network-traffic
1r 2t 1i
high threat

Possible FIN7 DGA Command and Control Behavior

FIN7 threat group utilizes a specific Domain Generation Algorithm (DGA) for command and control (C2), characterized by domains with 4-5 alphabetic characters and specific top-level domains such as .pw, .us, .club, .info, .site, or .top, enabling persistence and continued operations within target networks.

FIN7 +2 command-and-control dga network-traffic persistence
1r 2t
high threat

Windows Command-Line Tool Execution from Non-Shell Process

Detection of command-line tools such as `ipconfig.exe` and `systeminfo.exe` being executed from non-standard parent processes can indicate system discovery activity by threat actors like FIN7 using injected processes.

Windows FIN7 +2 discovery process-injection
2r 1t
high threat

FIN7 DGA Command and Control Behavior Detection

This rule detects command and control activity associated with the FIN7 threat group, which is known to use domain generation algorithms (DGA) to maintain persistence in their target's network by identifying network traffic using TLS or HTTP protocols to domains with a specific pattern.

FIN7 +2 command-and-control dga network_traffic
3r 2t