sentinelone operationDigitalEye Dec 2024

During Operation Digital Eye, threat actors targeted memory from the LSASS process to extract credentials.

During Operation Digital Eye, threat actors used `reg save` to retrieve credentials from the Security Account Manager (SAM) database.

During Operation Digital Eye, threat actors used Ping for reconnaissance.

During Operation Digital Eye, threat actors moved laterally using RDP.

PHPsert can use multiple obfuscation techniques including XOR encoding, hexadecimal character representation, string concatenation, and randomized variable names.

During Operation Digital Eye, threat actors used `GetUserInfo` to identify current user information.

During Operation Digital Eye, threat actors attempted to make filenames appear legitimate by tailoring them to the victim organization.

During Operation Digital Eye, threat actors used `cmd.exe` as a default method of execution for a custom version of Mimikatz named bK2o.exe.

During Operation Digital Eye, threat actors used the local.exe tool to view group memberships.

During Operation Digital Eye, threat actors deleted files delivered to compromised hosts, often named with the pattern do.* such as do.exe.

PHPsert can retrieve remote files using HTTP POST.

During Operation Digital Eye, threat actors used the local.exe tool to view local account information.

During Operation Digital Eye, threat actors used SSH access enabled by authorized_keys files for remote execution.

PHPsert has the ability to retrieve remote payloads.

During Operation Digital Eye, threat actors used native API such as `GetUserInfo`.

PHPsert can use Base64-encoded values in C2 communications.

PHPsert has the ability to decode and decrypt obfuscated strings prior to execution.

During Operation Digital Eye, threat actors used SQL injection to compromise publicly exposed web and database servers.

During Operation Digital Eye, threat actors created Visual Studio Code dev tunnels to access targeted endpoints through the browser-based version of Visual Studio Code.

During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.

PHPsert can use the .php assert function to execute attacker-provided code and maintain persistence on targeted web servers.

During Operation Digital Eye, threat actors created a service named Visual Studio Code Service to run Visual Studio code.

During Operation Digital Eye, threat actors used a pass-the-hash capability to move laterally.

During Operation Digital Eye, threat actors used the winsw tool to deploy a Visual Studio code executable as a Windows service.

During Operation Digital Eye, threat actors used third party tools including custom implementations of Mimikatz.

During Operation Digital Eye, threat actors concealed malicious activity by using terms that aligned with the technological context of the targeted organization.

During Operation Digital Eye, threat actors used the local language of targeted organizations to disguise file system activity.

During Operation Digital Eye, threat actors used public Cloud infrastructure to mask malicious activity.