Threat Actors: Salt Typhoon – SNAPPYBEE Campaign Analysis - Question 3

Question

For the question&nbsp;There is a .bat file that is executed on the victim machine. What is the file path of the .bat file?, for some reason I cant pick up any strings in general with that pattern. I am wondering if I should be parsing for something else such as a .zip, but event then. the "bat" keyword should have been picked up I believe&nbsp;

kevinh · Answer

note: I have also tried parsing through the keyword filter as per

https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/keyword and

from

https://www.elastic.co/docs/reference/ecs/ecs-file

Forum Discussion

Threat Actors: Salt Typhoon – SNAPPYBEE Campaign Analysis - Question 3

1 Reply

Featured Places

Help

Related Content

Malware Analysis: Tracking a LOLBins Campaign – Acquisition

Malware Analysis: Tracking a LOLBins Campaign – Examination

Malicious Document Analysis: Dropper Analysis

New CTI Labs: Threat Actors: Salt Typhoon – SNAPPYBEE Campaign Analysis & Threat Actors: Salt Typhoon

Practical Malware Analysis: Static Analysis

Recent Discussions

Threat Actors: Salt Typhoon – SNAPPYBEE Campaign Analysis - Question 3

Threat Actors: Mint Sandstorm – Campaign Analysis - Question 9

Apache Header Tampering

APT43: Malware Analysis - Question 8

Threat Actors: APT43 - Question 7