Skip to content
  • Reports
  • Analysts
  • Services
    • Threat Intelligence
    • Detection Rules
    • Case Artifacts
    • Mentoring & Coaching Program
      • Book A Session
      • Meet The Team
  • Merchandise
  • Subscribe
  • Contact Us
  • Threat Intelligence
  • Detection Rules
  • Case Artifacts
  • Mentoring & Coaching Program
    • Book A Session
    • Meet The Team

The DFIR Report

Real Intrusions by Real Attackers, The Truth Behind the Intrusion

  • Reports
  • Analysts
  • Services
    • Threat Intelligence
    • Detection Rules
    • Case Artifacts
    • Mentoring & Coaching Program
      • Book A Session
      • Meet The Team
  • Merchandise
  • Subscribe
  • Contact Us
Sunday, September 24, 2023
  • Threat Intelligence
  • Detection Rules
  • Case Artifacts
  • Mentoring & Coaching Program
    • Book A Session
    • Meet The Team

Category: coinminer

SELECT XMRig FROM SQLServer
coinminer exploit

SELECT XMRig FROM SQLServer

July 11, 2022

In March 2022, we observed an intrusion on a public-facing Microsoft SQL Server. The end goal of this intrusion was to deploy a coin miner. Although deploying a coin miner … Read More

All That for a Coinminer?
coinminer rdp

All That for a Coinminer?

January 18, 2021

A threat actor recently brute forced a local administrator password using RDP and then dumped credentials using Mimikatz. They not only dumped LogonPasswords but they also exported all Kerberos tickets. … Read More

Reports

Threat Intelligence

Detection Rules

Case Artifacts

Mentoring and Coaching

Copyright 2023 | The DFIR Report | All Rights Reserved