MVISION Insights: AgentTesla Campaign Targets the UAE

Technical Articles ID: KB95159
Last Modified: 1/13/2022

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by MVISION Insights technology. The content is intended for use by MVISION Insights users, but is provided for general knowledge to all customers. Contact us for more information about MVISION Insights.

Summary

Description of Campaign
The Dubai and the United Arab Emirates were targeted by a long-running AgentTesla info stealing campaign stretching from at least January 2021 until May 2021. A purchase order-themed email from a compromised email account was used to start the attacks. The email contained a .Gz archive file attached with the .NET AgentTesla payload inside. Credentials from mail clients, web browsers, and applications were exfiltrated over port 587 (SMTP) to two mail servers.

The McAfee Enterprise ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports.
This campaign was researched by Cyjax and shared publicly here.

How to use this article:

If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page.
Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
Review KB91836 - Countermeasures for entry vector threats.
Review KB87843 - Dynamic Application Containment rules and best practices.
Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that is being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.

Campaign IOC

Type	Value
SHA256	1B3E06C4B86583EDA3EB50CFF77909E1823C6E27DBDC800BCB8A1C0665BA9859
SHA256	D9CA404441F4FD669287063C72A7BEC77BED9922FC5C1ED5C251EBBFAC88EA8C
SHA256	9AE078AB46F4C0816081CF5F9D5E14535AB4D47EB3DCE659B9EC8D34224FC7CA
SHA256	CAAB2D0E7E9937E45BDD6D177C06691D0BFE812C2175ACD4DF0C7232955A3561
SHA256	04F64CBA67694E1BD825E93F4F666653DAA9FFEFDB0E5188D46E48DF57F08937
SHA256	FC3AD8DA7556A39D519505CFBBC57F6461E6E2D6D99AFA3A2DA3EE4FBCADACF3
SHA256	B859F18428DEF9309B60727774B2B9BCCD2D9E20EBC38AED036F025660895953
SHA256	A4E53DC706074B48F041B529B069068D6828AE4592C4FE9EA9574D7533CC5732
SHA256	443F97272D6085AB174DA65439FB10405F4C7988AA803591849F8D698A1B6B7C
SHA256	2DBB35A02DA3FB8FFA6C3886E8077B945D91F1CA3DD884EE4AE411B8D5D8C802
SHA256	FC0F36F3D10529BD0A8662822D3AE9AD28AEE1A768AA8381BC5A8347D88DCE41
SHA256	1D63743590E30CDC81AA48C4B04C709129F0775BC890E6821B6F13931455062D
SHA256	A152081C4B7A3F91EB1236E1705945231153E198BEF77F5304E3E377C3329A72
SHA256	507DD7E9AB7C21513C515FF90F21A0B79B2B7B5A907C9FEF6A6589308B84B169
SHA256	36D21E7D4F8ACEEB7FBBA97971A78BABC193F0948002EAE4A2FBAC21387941F0
SHA256	0176C00A0B9DAF9F236064EC276A0F4ED83C9D47DAD0A7F7513B4E326CD4F50F
SHA256	28FD4C575B17625513BAA2117464676CD0D45693A4A1B819AEF3D8B7AB8AC1F8
SHA256	ADB4CCD1C76DF62C9F045123561BF6057F591CDD312AF9CA56D7E9BD5C72470F
SHA256	40640EFC073133FAC59933C96DC686B40CFBB31EE2022016CFCE79E7860AE914
SHA256	F72D9A731CF2A1928D0E3CBBF09B0DD8F680A1DDEA3DD58B703384889FA0427B
SHA256	A0CDEE78A35808FCBE07C66EBDB3C6E035D880ACB0A8C579012B875C4CEED1D2
SHA256	8BED3ADBB5219D9A870036D1F1EEB9F6E7DB060C7ED46A801967A3CF052FA744
SHA256	C17FD87D4000FB0B0EAA0E47F3124DAE4197BFCD06572213BE65EFA85DE500FC
SHA256	AF539110EF2B28F248F4FCFC0AC516789B8DBE85751458B352878B7E0376C4F6
SHA256	24A66D93FE7887F5E68B084FE2A7301CD09CB8F9F21B320322BB0181DD2900A9
SHA256	3B1FE364709C48334556ED44307D960C959A623E354619D6783D45E1554C3495
SHA256	F96709AB035E1A8FA122C22E2C93BCC560DE2F02CFC6C73E1AF397B3AB184A0A
SHA256	62E8A7A2AB091ECF3D0F575C91EE4F5FE2C3DEFE314EDA6091947E017F7FE804
SHA256	6A046F61112CAB2069EA17340C0FF2F946918CDD23FA522CB869CFF839E9CCC0
SHA256	3D51B9416E552E76181352626F39FA98FB36B600DAAC6AC2FBDEEB3EFCC55EE0
SHA256	8A6EBDF828B6E2E46CBF9C8C43CA7379ADF01CB60E22210984DF86B6D779C12A
SHA256	5A531F14191E7FCA46231F8DFFA8A8D0DE8C2EDA180274E66772415D95639641
SHA256	E13DF94083C7899CAA1976C39F45704038DD759FA593F5D48B643CA9555DA375
SHA256	2C0E7AA3BDF271A381A62095BA3398BCF46E70E1C2819E0A9802452CA5B1594E
SHA256	8BB298FCC8AE3CFBF4E3BE43C3A1B8A2CBEE1981215DF099BF3EC28846070B7D
SHA256	231783B893AC82018D3CCCA49281D3E4118FE7BC40310349B17C4F83880425D9
SHA256	97A12C18F01E641B0C1704E4957D0CF0660E7563484FA9FD43637551EF425E1D
SHA256	CC7927680E22C12FF0963976C163BC295792625606CCBD3A69F96E2FAECB13A2
SHA256	38670FAC4494C85EC8DA0A8E44CDB89846FAFD5CE3DEAB20F6436D59A593E246
SHA256	36706DDD335E1182C5B5927C142627F23F301A6414428DD511B6598702BF2B5B
SHA256	F4ABC652263E67854D8F59926CD1F2B66308CC1DB123D10EE0E35CE53DF51927
SHA256	A3CDEEF513EBA7070F5970FED92B837718066E9B07D634DA7D18054E8972FDAA
SHA256	9DEF7872203CE02926419E3F1B3EEBF992B15F215EA729DF0EB3A2D101E189E1
SHA256	982152307F753BF7F4E4D0AA89BC181580FC115E70F2438BC1F0D940617DCAE5
SHA256	CB9567BD59E051A80E96C8400A206BE0FD05B3E3A03869519EC89B4CBB1993D3
SHA256	B28225EC61C861182F45D1226614FEDD02951415A8E74BC46E70637BBC55D59D
SHA256	9E791BF9E0DA41ABF616760711FDF7A57A46D96DAAA1884BD055212A52A73C08
SHA256	D2D44287E770417CC51A55B47856013003CE4B9C4DA496C4E12BD4026ABB8219
SHA256	9CFCABD747318CBDDE23A30C7A4A2E502EA21C2DA4E5E5E4F55F23911D10C94A
SHA256	9AC15F7D9B65E050B5150B83AC899877FC6A82DBBB937D9FDD19FA6EF51B85C1
SHA256	5B51125331F70D1FD729ACD83B722CCEB58DCD5218C38B21DDDE3054CF78A5B6
SHA256	650C369C2AA276AE5933B5E1D85A95B15B17DD5B0107D7296FC384A936BE836B
SHA256	B1FC4E0A03727FF3792E69B23A447D2986112B45C62C343166321D65F40B0DD4

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	10138
V3 DAT (Endpoint Security)	4590

Detection Summary

IOC	Scanner	Detection
1B3E06C4B86583EDA3EB50CFF77909E1823C6E27DBDC800BCB8A1C0665BA9859	AVEngine V2	PWS-FCUF!5A71D934F5BF
	AVEngine V3	PWS-FCUF!5A71D934F5BF
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D9CA404441F4FD669287063C72A7BEC77BED9922FC5C1ED5C251EBBFAC88EA8C	AVEngine V2	PWS-FCVT!BF9296CAC895
	AVEngine V3	PWS-FCVT!BF9296CAC895
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9AE078AB46F4C0816081CF5F9D5E14535AB4D47EB3DCE659B9EC8D34224FC7CA	AVEngine V2	PWS-FCUZ!BBAB9A530CAE
	AVEngine V3	PWS-FCUZ!BBAB9A530CAE
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CAAB2D0E7E9937E45BDD6D177C06691D0BFE812C2175ACD4DF0C7232955A3561	AVEngine V2	PWS-FCUZ!BBAB9A530CAE
	AVEngine V3	PWS-FCUZ!BBAB9A530CAE
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
04F64CBA67694E1BD825E93F4F666653DAA9FFEFDB0E5188D46E48DF57F08937	AVEngine V2	PWS-FCUF!7FFCA9228A28
	AVEngine V3	PWS-FCUF!7FFCA9228A28
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FC3AD8DA7556A39D519505CFBBC57F6461E6E2D6D99AFA3A2DA3EE4FBCADACF3	AVEngine V2	PWS-FCUF!3D14F73C844E
	AVEngine V3	PWS-FCUF!3D14F73C844E
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B859F18428DEF9309B60727774B2B9BCCD2D9E20EBC38AED036F025660895953	AVEngine V2	PWS-FCUF!27D3F3AF00BC
	AVEngine V3	PWS-FCUF!27D3F3AF00BC
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A4E53DC706074B48F041B529B069068D6828AE4592C4FE9EA9574D7533CC5732	AVEngine V2	PWS-FCVT!799FA109B565
	AVEngine V3	PWS-FCVT!799FA109B565
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
443F97272D6085AB174DA65439FB10405F4C7988AA803591849F8D698A1B6B7C	AVEngine V2	PWS-FCUF!81648C99ED42
	AVEngine V3	PWS-FCUF!81648C99ED42
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2DBB35A02DA3FB8FFA6C3886E8077B945D91F1CA3DD884EE4AE411B8D5D8C802	AVEngine V2	PWS-FCUF!85DB7308C690
	AVEngine V3	PWS-FCUF!85DB7308C690
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FC0F36F3D10529BD0A8662822D3AE9AD28AEE1A768AA8381BC5A8347D88DCE41	AVEngine V2	PWS-FCUF!66D8203E9737
	AVEngine V3	PWS-FCUF!66D8203E9737
	JTI (ATP Rules)	JTI/Suspect.196612!66d8203e9737
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
1D63743590E30CDC81AA48C4B04C709129F0775BC890E6821B6F13931455062D	AVEngine V2	PWS-FCUF!3D14F73C844E
	AVEngine V3	PWS-FCUF!3D14F73C844E
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A152081C4B7A3F91EB1236E1705945231153E198BEF77F5304E3E377C3329A72	AVEngine V2	PWS-FCZG!D71F83565F6E
	AVEngine V3	PWS-FCZG!D71F83565F6E
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
507DD7E9AB7C21513C515FF90F21A0B79B2B7B5A907C9FEF6A6589308B84B169	AVEngine V2	PWS-FCXL!8512456CCBB3
	AVEngine V3	PWS-FCXL!8512456CCBB3
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
36D21E7D4F8ACEEB7FBBA97971A78BABC193F0948002EAE4A2FBAC21387941F0	AVEngine V2	PWS-FCUF!006160A4314A
	AVEngine V3	PWS-FCUF!006160A4314A
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
0176C00A0B9DAF9F236064EC276A0F4ED83C9D47DAD0A7F7513B4E326CD4F50F	AVEngine V2	PWS-FCVT!799FA109B565
	AVEngine V3	PWS-FCVT!799FA109B565
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
28FD4C575B17625513BAA2117464676CD0D45693A4A1B819AEF3D8B7AB8AC1F8	AVEngine V2	PWS-FCXL!40892578A376
	AVEngine V3	PWS-FCXL!40892578A376
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
ADB4CCD1C76DF62C9F045123561BF6057F591CDD312AF9CA56D7E9BD5C72470F	AVEngine V2	PWS-FCUF!F9B318972C61
	AVEngine V3	PWS-FCUF!F9B318972C61
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
40640EFC073133FAC59933C96DC686B40CFBB31EE2022016CFCE79E7860AE914	AVEngine V2	PWS-FCUF!CEBCDDE7E771
	AVEngine V3	PWS-FCUF!CEBCDDE7E771
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
F72D9A731CF2A1928D0E3CBBF09B0DD8F680A1DDEA3DD58B703384889FA0427B	AVEngine V2	PWS-FCUF!3D14F73C844E
	AVEngine V3	PWS-FCUF!3D14F73C844E
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A0CDEE78A35808FCBE07C66EBDB3C6E035D880ACB0A8C579012B875C4CEED1D2	AVEngine V2	PWS-FCUF!25D374CBFED3
	AVEngine V3	PWS-FCUF!25D374CBFED3
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8BED3ADBB5219D9A870036D1F1EEB9F6E7DB060C7ED46A801967A3CF052FA744	AVEngine V2	PWS-FCUF!66D8203E9737
	AVEngine V3	PWS-FCUF!66D8203E9737
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C17FD87D4000FB0B0EAA0E47F3124DAE4197BFCD06572213BE65EFA85DE500FC	AVEngine V2	PWS-FCUF!830350C076C9
	AVEngine V3	PWS-FCUF!830350C076C9
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AF539110EF2B28F248F4FCFC0AC516789B8DBE85751458B352878B7E0376C4F6	AVEngine V2	PWS-FCUZ!AAB479F9EDFF
	AVEngine V3	PWS-FCUZ!AAB479F9EDFF
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
24A66D93FE7887F5E68B084FE2A7301CD09CB8F9F21B320322BB0181DD2900A9	AVEngine V2	GenericRXNL-EU!879BD6DD7CCA
	AVEngine V3	GenericRXNL-EU!879BD6DD7CCA
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3B1FE364709C48334556ED44307D960C959A623E354619D6783D45E1554C3495	AVEngine V2	PWS-FCUF!71DC44929EBB
	AVEngine V3	PWS-FCUF!71DC44929EBB
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
F96709AB035E1A8FA122C22E2C93BCC560DE2F02CFC6C73E1AF397B3AB184A0A	AVEngine V2	PWS-FCUF!822ECE4988B0
	AVEngine V3	PWS-FCUF!822ECE4988B0
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
62E8A7A2AB091ECF3D0F575C91EE4F5FE2C3DEFE314EDA6091947E017F7FE804	AVEngine V2	PWS-FCUF!830350C076C9
	AVEngine V3	PWS-FCUF!830350C076C9
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
6A046F61112CAB2069EA17340C0FF2F946918CDD23FA522CB869CFF839E9CCC0	AVEngine V2	PWS-FCXL!40892578A376
	AVEngine V3	PWS-FCXL!40892578A376
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3D51B9416E552E76181352626F39FA98FB36B600DAAC6AC2FBDEEB3EFCC55EE0	AVEngine V2	PWS-FCUF!62BFD97DC441
	AVEngine V3	PWS-FCUF!62BFD97DC441
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8A6EBDF828B6E2E46CBF9C8C43CA7379ADF01CB60E22210984DF86B6D779C12A	AVEngine V2	PWS-FCUF!717AA0D59EB1
	AVEngine V3	PWS-FCUF!717AA0D59EB1
	JTI (ATP Rules)	JTI/Suspect.196612!717aa0d59eb1
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5A531F14191E7FCA46231F8DFFA8A8D0DE8C2EDA180274E66772415D95639641	AVEngine V2	PWS-FCUF!25D374CBFED3
	AVEngine V3	PWS-FCUF!25D374CBFED3
	JTI (ATP Rules)	JTI/Suspect.196612!25d374cbfed3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
E13DF94083C7899CAA1976C39F45704038DD759FA593F5D48B643CA9555DA375	AVEngine V2	PWS-FCUF!7FFCA9228A28
	AVEngine V3	PWS-FCUF!7FFCA9228A28
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2C0E7AA3BDF271A381A62095BA3398BCF46E70E1C2819E0A9802452CA5B1594E	AVEngine V2	PWS-FCXL!40892578A376
	AVEngine V3	PWS-FCXL!40892578A376
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8BB298FCC8AE3CFBF4E3BE43C3A1B8A2CBEE1981215DF099BF3EC28846070B7D	AVEngine V2	PWS-FCUF!006160A4314A
	AVEngine V3	PWS-FCUF!006160A4314A
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
231783B893AC82018D3CCCA49281D3E4118FE7BC40310349B17C4F83880425D9	AVEngine V2	PWS-FCUF!62BFD97DC441
	AVEngine V3	PWS-FCUF!62BFD97DC441
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
97A12C18F01E641B0C1704E4957D0CF0660E7563484FA9FD43637551EF425E1D	AVEngine V2	GenericRXNL-EU!879BD6DD7CCA
	AVEngine V3	GenericRXNL-EU!879BD6DD7CCA
	JTI (ATP Rules)	JTI/Suspect.196612!879bd6dd7cca
	RP Static	Real Protect-XGPE!879BD6DD7CCA
	RP Dynamic	-

IOC	Scanner	Detection
CC7927680E22C12FF0963976C163BC295792625606CCBD3A69F96E2FAECB13A2	AVEngine V2	PWS-FCVV!5B997F3562F0
	AVEngine V3	PWS-FCVV!5B997F3562F0
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
38670FAC4494C85EC8DA0A8E44CDB89846FAFD5CE3DEAB20F6436D59A593E246	AVEngine V2	PWS-FCUF!822ECE4988B0
	AVEngine V3	PWS-FCUF!822ECE4988B0
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
36706DDD335E1182C5B5927C142627F23F301A6414428DD511B6598702BF2B5B	AVEngine V2	PWS-FCUF!717AA0D59EB1
	AVEngine V3	PWS-FCUF!717AA0D59EB1
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
F4ABC652263E67854D8F59926CD1F2B66308CC1DB123D10EE0E35CE53DF51927	AVEngine V2	PWS-FCUZ!AAB479F9EDFF
	AVEngine V3	PWS-FCUZ!AAB479F9EDFF
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A3CDEEF513EBA7070F5970FED92B837718066E9B07D634DA7D18054E8972FDAA	AVEngine V2	PWS-FCUF!71DC44929EBB
	AVEngine V3	PWS-FCUF!71DC44929EBB
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9DEF7872203CE02926419E3F1B3EEBF992B15F215EA729DF0EB3A2D101E189E1	AVEngine V2	PWS-FCVV!5B997F3562F0
	AVEngine V3	PWS-FCVV!5B997F3562F0
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
982152307F753BF7F4E4D0AA89BC181580FC115E70F2438BC1F0D940617DCAE5	AVEngine V2	PWS-FCVT!BF9296CAC895
	AVEngine V3	PWS-FCVT!BF9296CAC895
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CB9567BD59E051A80E96C8400A206BE0FD05B3E3A03869519EC89B4CBB1993D3	AVEngine V2	PWS-FCUF!5A71D934F5BF
	AVEngine V3	PWS-FCUF!5A71D934F5BF
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B28225EC61C861182F45D1226614FEDD02951415A8E74BC46E70637BBC55D59D	AVEngine V2	PWS-FCUF!CEBCDDE7E771
	AVEngine V3	PWS-FCUF!CEBCDDE7E771
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9E791BF9E0DA41ABF616760711FDF7A57A46D96DAAA1884BD055212A52A73C08	AVEngine V2	PWS-FCUF!F9B318972C61
	AVEngine V3	PWS-FCUF!F9B318972C61
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D2D44287E770417CC51A55B47856013003CE4B9C4DA496C4E12BD4026ABB8219	AVEngine V2	PWS-FCUF!85DB7308C690
	AVEngine V3	PWS-FCUF!85DB7308C690
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9CFCABD747318CBDDE23A30C7A4A2E502EA21C2DA4E5E5E4F55F23911D10C94A	AVEngine V2	PWS-FCUF!81648C99ED42
	AVEngine V3	PWS-FCUF!81648C99ED42
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9AC15F7D9B65E050B5150B83AC899877FC6A82DBBB937D9FDD19FA6EF51B85C1	AVEngine V2	PWS-FCXL!8512456CCBB3
	AVEngine V3	PWS-FCXL!8512456CCBB3
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5B51125331F70D1FD729ACD83B722CCEB58DCD5218C38B21DDDE3054CF78A5B6	AVEngine V2	PWS-FCZG!D71F83565F6E
	AVEngine V3	PWS-FCZG!D71F83565F6E
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
650C369C2AA276AE5933B5E1D85A95B15B17DD5B0107D7296FC384A936BE836B	AVEngine V2	PWS-FCUF!27D3F3AF00BC
	AVEngine V3	PWS-FCUF!27D3F3AF00BC
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B1FC4E0A03727FF3792E69B23A447D2986112B45C62C343166321D65F40B0DD4	AVEngine V2	PWS-FCUF!0AB1493670CA
	AVEngine V3	PWS-FCUF!0AB1493670CA
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 4 Use GTI file reputation to identify trusted or malicious files

Endpoint Security - Exploit Prevention:

Rule ID: 6086 Powershell Command Restriction - Command
Rule ID: 6135 Unmanaged Powershell Detected

Host Intrusion Prevention:

Rule ID: 6135 Unmanaged Powershell Detected

Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Virusscan Enterprise - Access Protection Rules:

Prevent programs registering as a service
Prevent creation of new executable files in the Windows folder

Host Intrusion Prevention:

Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 6011 Generic Application Invocation Protection
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 1148 CMD Tool Access by a Network Aware Application
Rule ID: 6010 Generic Application Hooking Protection

Affected Products

MVISION Insights

Knowledge Center

MVISION Insights: AgentTesla Campaign Targets the UAE

Environment

Summary

Affected Products

Title

Title

Knowledge Center

MVISION Insights: AgentTesla Campaign Targets the UAE

Environment

Summary

Affected Products

Choose your region

Title

Title