MVISION Insights: Lockean Threat Group Targets Multiple French Sectors

Technical Articles ID: KB95169
Last Modified: 1/13/2022

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by MVISION Insights technology. The content is intended for use by MVISION Insights users, but is provided for general knowledge to all customers. Contact us for more information about MVISION Insights.

Summary

Description of Campaign
The National Cybersecurity Agency of France (ANSSI) investigated incidents involving Qakbot infections that were reported to ANSSI from 2020-2021. The correlations made between the incidents involving these French companies helped in identifying commonalities in TTPs as well as naming conventions and the malware used. This led to the identification of a new threat group, which is now being tracked as Lockean. Along with the initial Qakbot infections, the threat actor was seen delivering Cobalt Strike which was using spoofed Akamai and Azure domains for C2 communication, Rclone for data exfiltration, and the final payloads being one of a few RaaS payloads.

The McAfee Enterprise ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports.
This campaign was researched by CERT-FR and shared publicly here.

How to use this article:

If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page.
Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
Review KB91836 - Countermeasures for entry vector threats.
Review KB87843 - Dynamic Application Containment rules and best practices.
Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that is being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.

Campaign IOC

Type	Value
SHA256	4C9E3FFDA0E663217638E6192A093BBC23CD9EBFBDF6D2FC683F331BEAEE0321
SHA256	3144216F5151B4B7FC059E0B5882A4680BB17A179B46715EDBB054338EE0DF74
SHA256	F3C3E2CBEDAFD594B40EFE12AE2A638489A7065DC2E1657524877FE0BD15D6C8
SHA256	33380FFAD5876DC6DFF3DEFCDF911FDFE3BC22677D9B10F3477BEF95FD2E0A96
SHA256	997FC0678899EEDB511541BA9DFCF1A4823F5730D72A576CC12320EE49E3EC65
SHA256	51ED1EA8C11656FA2300A5424DB4B0998BE5B383AD54AED547C1F2C70FA96959
SHA256	516FB7B0F610494D2702C31402DCB1116A489760F70EA102C900482D0514F465
SHA256	DAA9DDF216DE176801E3A77B3F7A33691D92E2AB70E9F1C1AECEBAB6D21B1192
SHA256	2B3518937FD231560C7DC4F5AF672A033B1C810D7F2F82C8151C025CE75775BF
SHA256	8483AAF9E1FA5B46486C9F2A14C688C30D2006E88DE65D0295A57892DE0BF4C9
SHA256	7C1B18932F622126441802F5CCAA9EEFB88465D83A4A527D2C7CA2BAB404B373
SHA256	2450297D7EF66A5573AB6450AA5578F7E4C293B809F02CDAC7126AD55F0E8549
SHA256	030B30AA08D6955526E37FC7918340B7F672CF92578F82BF0C93A0361539975D
SHA256	B5A90A7357DDD95C88A6F042F9A5B9D388CE936DF393987A565209A140046905
SHA256	175A611670E535EF1033F4CB95AFD974B24334C2CEDDB26B320CA14455A40BB6
SHA256	9B40C9513CAE3BEBCBE6CF7E9C85A6C4D6986482A5F889F50C1E891E246BEC8C
SHA256	D885209207B11F3ED12C9698ECB3FEBAA34EC7AB06A3B8F02DE93BD3F6FF2111
SHA256	5094E17105845238A6A2AAF54CD6769733032009A9DDD24E8AF046837C1C12E6
SHA256	57B24F50D87B740EED6A0D8A9E2E5B9F2D99F4454D3C5C8DE2E1A5E9081A617D
SHA256	A2869406C4661B2C003F0D38AEBE8F8E5715BDBC7D67E429023CB0726DBC13F5
SHA256	ADA3608B57C864E2AF35C3D465E1685581D53B7D74C23557CE8A5D965AAB56E3
SHA256	4EA8B8C37CFB02CCDBA95FE91C12FB68A2B7174FDCBEE7DDAADDED8CEB0FDF97
SHA256	88D89E9A3EB88B44E9109185F880ECCC5ECB2ED1DF906DB25677E18EBAFF1F47
SHA256	CF6FEA34AF1F1E02CFC44A685BC90C9C8C04E18A722CCF61EC73D952DF774F80
SHA256	FEC51F04710E3AAE47DD23B084D8A364FA07C25DDA5B229AEB3E6A98C56FA869
SHA256	BC358AD0917C5BF4D3ED1D552DC9D1704ADD0AF352EA357BF3DD05D4605BB2B2
SHA256	412ABE96CBBD685E888126581AE6485AA2038A31578FB122E38A2387400ABA0E
SHA256	7ABF8F3A438DF6336B84C81019E81DB57B7D98766E6897315789CE138F3C4AC3
DOMAIN	adjustclouds.com
DOMAIN	akabox.space
DOMAIN	akabox.tech
DOMAIN	akamacloud.pro
DOMAIN	akamacloud.tech
DOMAIN	akamaclouds.app
DOMAIN	akamaclouds.tech
DOMAIN	akamai-technologies.digital
DOMAIN	akamai-technologies.host
DOMAIN	akamai-technologies.online
DOMAIN	akamai-technologies.site
DOMAIN	akamai-technologies.space
DOMAIN	akamai-technologies.website
DOMAIN	akamalupdate.site
DOMAIN	akastat.app
DOMAIN	amajai-technologies.digital
DOMAIN	amajai-technologies.host
DOMAIN	amajai-technologies.industries
DOMAIN	amajai-technologies.network
DOMAIN	amajai-technologies.online
DOMAIN	amajai-technologies.site
DOMAIN	amajai-technologies.space
DOMAIN	amajai-technologies.support
DOMAIN	amajai-technologies.tech
DOMAIN	amajai-technologies.trade
DOMAIN	amajai-technologies.website
DOMAIN	amajai-technologies.work
DOMAIN	amajai-technologies.world
DOMAIN	amamai-tecnologies.cloud
DOMAIN	amamai-tecnologies.digital
DOMAIN	amamai-tecnologies.space
DOMAIN	amapai-technologies.digital
DOMAIN	amapai-technologies.email
DOMAIN	amapai-technologies.site
DOMAIN	amapai-technologies.space
DOMAIN	amapai-technologies.support
DOMAIN	amapai-technologies.website
DOMAIN	amapai-technologies.work
DOMAIN	amapai-technologies.world
DOMAIN	amasonstore.com
DOMAIN	amatai-technologies.digital
DOMAIN	amatai-technologies.site
DOMAIN	amatai-technologies.space
DOMAIN	amatai-technologies.website
DOMAIN	amazai-technologies.online
DOMAIN	amazai-technologies.site
DOMAIN	amazai-technologies.space
DOMAIN	amazai-technologies.support
DOMAIN	amazai-technologies.website
DOMAIN	amazai-technologies.world
DOMAIN	asurecloud.pro
DOMAIN	asurecloud.tech
DOMAIN	asureupdate.pro
DOMAIN	asureupdate.tech
DOMAIN	atakai-technologies.host
DOMAIN	atakai-technologies.online
DOMAIN	atakai-technologies.space
DOMAIN	atakai-technologies.website
DOMAIN	atakai-technologies.work
DOMAIN	azuresecure.tech
DOMAIN	azurestat.app
DOMAIN	cdnengine.biz
DOMAIN	classworldint.com
DOMAIN	cloudflace-network.digital
DOMAIN	cloudmetric.online
DOMAIN	dealsforyoutoday.org
DOMAIN	displaychecks.com
DOMAIN	electronicwhosaleonline.com
DOMAIN	entirelysecuritybusiness.com
DOMAIN	hesitatesecuritybusiness.com
DOMAIN	itstrueloves.com
DOMAIN	justicedev.com
DOMAIN	killsecuritybusiness.com
DOMAIN	knotsecuritybusiness.com
DOMAIN	madesecuritybusiness.com
DOMAIN	notescloud.org
DOMAIN	onlineceoshelp.com
DOMAIN	orientalclient.com
DOMAIN	perfectappt.com
DOMAIN	rackspare-technology.digital
DOMAIN	rackspare-technology.download
DOMAIN	rackspare-technology.network
DOMAIN	rackspare-technology.online
DOMAIN	rackspare-technology.space
DOMAIN	risetomoon.com
DOMAIN	ropesecuritybusiness.com
DOMAIN	securesurvey.cloud
DOMAIN	securitybusinessmean.com
DOMAIN	securitypanels.org
DOMAIN	setupfastonline.com
DOMAIN	smalleststores.com
DOMAIN	stackpatc-technologies.digital
DOMAIN	stexwhosaleonline.com
DOMAIN	ticksecuritybusiness.com
HOSTNAME	c2.hax.vg
IP-DST	93.190.140.75
IP-DST	45.147.160.5
IP-DST	185.238.0.233
IP-DST	23.254.229.82
IP-DST	192.236.209.151
IP-DST	185.245.84.133
IP-DST	138.201.149.51
IP-DST	194.15.112.119
IP-DST	66.181.34.13
IP-DST	45.86.163.78
IP-DST	195.189.99.74
IP-DST	91.134.187.27
IP-DST	66.181.34.16
IP-DST	37.120.239.145
IP-DST	80.209.228.62
IP-DST	204.16.247.35
IP-DST	74.118.138.174
IP-DST	23.108.57.245
IP-DST	23.108.57.31
IP-DST	204.16.247.224
IP-DST	23.82.185.111
IP-DST	108.177.235.180
IP-DST	213.227.154.244
IP-DST	46.30.188.31
IP-DST	45.138.172.91
IP-DST	74.118.138.235
IP-DST	108.177.235.52
IP-DST	23.82.185.110
IP-DST	108.177.235.44
IP-DST	46.17.63.191
IP-DST	172.241.29.156
IP-DST	172.241.29.155
IP-DST	172.241.27.72
IP-DST	172.241.27.44
IP-DST	172.241.27.66
IP-DST	172.241.27.225
IP-DST	172.241.27.17
IP-DST	192.236.193.203
IP-DST	192.236.194.99
IP-DST	192.236.232.228
IP-DST	192.236.193.184
IP-DST	23.254.230.196
IP-DST	23.254.224.62
IP-DST	23.254.202.217
IP-DST	192.236.209.144
IP-DST	192.236.209.150
IP-DST	23.254.229.91
IP-DST	23.254.229.103
IP-DST	45.147.230.0
IP-DST	45.147.231.51
IP-DST	45.153.243.215
IP-DST	108.62.118.37
IP-DST	23.106.160.137
IP-DST	23.106.160.138
IP-DST	142.11.227.114
IP-DST	95.174.65.241
IP-DST	185.245.84.132
IP-DST	45.11.19.217
IP-DST	94.158.244.88
URL	http://185.238.0.233/archbi.zip
URL	http://185.238.0.233/b.dll
URL	http://185.238.0.233/hnt.dll
URL	http://185.238.0.233/kk.dll
URL	http://185.238.0.233/p.dll
URL	http://185.238.0.233/88/k057.exe
URL	http://185.238.0.233/k068.exe
URL	http://185.238.0.233/k071sm.exe

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	10168
V3 DAT (Endpoint Security)	4618

Detection Summary

IOC	Scanner	Detection
4C9E3FFDA0E663217638E6192A093BBC23CD9EBFBDF6D2FC683F331BEAEE0321	AVEngine V2	Ransom-Egregor!A654B3A37C27
	AVEngine V3	Ransom-Egregor!A654B3A37C27
	JTI (ATP Rules)	JTI/Suspect.196612!a654b3a37c27
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3144216F5151B4B7FC059E0B5882A4680BB17A179B46715EDBB054338EE0DF74	AVEngine V2	W32/PinkSbot-HC!E166035566A9
	AVEngine V3	W32/PinkSbot-HC!E166035566A9
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
F3C3E2CBEDAFD594B40EFE12AE2A638489A7065DC2E1657524877FE0BD15D6C8	AVEngine V2	GenericRXLX-YI!E95053D1EAC4
	AVEngine V3	GenericRXLX-YI!E95053D1EAC4
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
33380FFAD5876DC6DFF3DEFCDF911FDFE3BC22677D9B10F3477BEF95FD2E0A96	AVEngine V2	W32/PinkSbot-HC!69ED71C758F3
	AVEngine V3	W32/PinkSbot-HC!69ED71C758F3
	JTI (ATP Rules)	JTI/Suspect.196612!69ed71c758f3
	RP Static	Real Protect-PENG4!69ED71C758F3
	RP Dynamic	-

IOC	Scanner	Detection
997FC0678899EEDB511541BA9DFCF1A4823F5730D72A576CC12320EE49E3EC65	AVEngine V2	W32/PinkSbot-HL!A9D59DAEB3B0
	AVEngine V3	W32/PinkSbot-HL!A9D59DAEB3B0
	JTI (ATP Rules)	JTI/Suspect.196612!a9d59daeb3b0
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
51ED1EA8C11656FA2300A5424DB4B0998BE5B383AD54AED547C1F2C70FA96959	AVEngine V2	W32/PinkSbot-HC!3F0879776F93
	AVEngine V3	W32/PinkSbot-HC!3F0879776F93
	JTI (ATP Rules)	JTI/Suspect.196612!3f0879776f93
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
516FB7B0F610494D2702C31402DCB1116A489760F70EA102C900482D0514F465	AVEngine V2	GenericRXAA-AA!3A059AB3CBC1
	AVEngine V3	GenericRXAA-AA!3A059AB3CBC1
	JTI (ATP Rules)	JTI/Suspect.196612!3a059ab3cbc1
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
DAA9DDF216DE176801E3A77B3F7A33691D92E2AB70E9F1C1AECEBAB6D21B1192	AVEngine V2	W32/PinkSbot-HC!5D60EF2D7CB0
	AVEngine V3	W32/PinkSbot-HC!5D60EF2D7CB0
	JTI (ATP Rules)	JTI/Suspect.196612!5d60ef2d7cb0
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2B3518937FD231560C7DC4F5AF672A033B1C810D7F2F82C8151C025CE75775BF	AVEngine V2	GenericRXLV-UK!81BC3A240999
	AVEngine V3	GenericRXLV-UK!81BC3A240999
	JTI (ATP Rules)	JTI/Suspect.196612!81bc3a240999
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
8483AAF9E1FA5B46486C9F2A14C688C30D2006E88DE65D0295A57892DE0BF4C9	AVEngine V2	GenericRXMA-ZM!44A7085F729B
	AVEngine V3	GenericRXMA-ZM!44A7085F729B
	JTI (ATP Rules)	JTI/Suspect.196612!44a7085f729b
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7C1B18932F622126441802F5CCAA9EEFB88465D83A4A527D2C7CA2BAB404B373	AVEngine V2	GenericRXLV-UK!E406D6097C42
	AVEngine V3	GenericRXLV-UK!E406D6097C42
	JTI (ATP Rules)	JTI/Suspect.196612!e406d6097c42
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
2450297D7EF66A5573AB6450AA5578F7E4C293B809F02CDAC7126AD55F0E8549	AVEngine V2	Generic Obfuscated.g
	AVEngine V3	Generic Obfuscated.g
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
030B30AA08D6955526E37FC7918340B7F672CF92578F82BF0C93A0361539975D	AVEngine V2	GenericRXMA-ZM!27FA39E6FB06
	AVEngine V3	GenericRXMA-ZM!27FA39E6FB06
	JTI (ATP Rules)	-
	RP Static	Real Protect-PENG4!27FA39E6FB06
	RP Dynamic	-

IOC	Scanner	Detection
B5A90A7357DDD95C88A6F042F9A5B9D388CE936DF393987A565209A140046905	AVEngine V2	Packed-GCB!4568B57AD465
	AVEngine V3	Packed-GCB!4568B57AD465
	JTI (ATP Rules)	JTI/Suspect.196612!4568b57ad465
	RP Static	Real Protect-LS!4568B57AD465
	RP Dynamic	-

IOC	Scanner	Detection
175A611670E535EF1033F4CB95AFD974B24334C2CEDDB26B320CA14455A40BB6	AVEngine V2	W32/PinkSbot-HL!16F84C82E6F0
	AVEngine V3	W32/PinkSbot-HL!16F84C82E6F0
	JTI (ATP Rules)	JTI/Suspect.196612!16f84c82e6f0
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9B40C9513CAE3BEBCBE6CF7E9C85A6C4D6986482A5F889F50C1E891E246BEC8C	AVEngine V2	Drixed-FJV!005CDB347480
	AVEngine V3	Drixed-FJV!005CDB347480
	JTI (ATP Rules)	JTI/Suspect.196612!005cdb347480
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D885209207B11F3ED12C9698ECB3FEBAA34EC7AB06A3B8F02DE93BD3F6FF2111	AVEngine V2	Packed-GCB!AE95189F757D
	AVEngine V3	Packed-GCB!AE95189F757D
	JTI (ATP Rules)	JTI/Suspect.196612!ae95189f757d
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5094E17105845238A6A2AAF54CD6769733032009A9DDD24E8AF046837C1C12E6	AVEngine V2	W32/PinkSbot-HF!04416CF8BF1C
	AVEngine V3	W32/PinkSbot-HF!04416CF8BF1C
	JTI (ATP Rules)	JTI/Suspect.196612!04416cf8bf1c
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
57B24F50D87B740EED6A0D8A9E2E5B9F2D99F4454D3C5C8DE2E1A5E9081A617D	AVEngine V2	W32/PinkSbot-HA!83B15F14E171
	AVEngine V3	W32/PinkSbot-HA!83B15F14E171
	JTI (ATP Rules)	-
	RP Static	Real Protect-PENG4!83B15F14E171
	RP Dynamic	-

IOC	Scanner	Detection
A2869406C4661B2C003F0D38AEBE8F8E5715BDBC7D67E429023CB0726DBC13F5	AVEngine V2	Generic trojan.pf
	AVEngine V3	Generic trojan.pf
	JTI (ATP Rules)	JTI/Suspect.196612!f8bedd553a00
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
ADA3608B57C864E2AF35C3D465E1685581D53B7D74C23557CE8A5D965AAB56E3	AVEngine V2	W32/PinkSbot-HC!D92312B6A956
	AVEngine V3	W32/PinkSbot-HC!D92312B6A956
	JTI (ATP Rules)	JTI/Suspect.196612!d92312b6a956
	RP Static	Real Protect-PENG4!D92312B6A956
	RP Dynamic	-

IOC	Scanner	Detection
4EA8B8C37CFB02CCDBA95FE91C12FB68A2B7174FDCBEE7DDAADDED8CEB0FDF97	AVEngine V2	GenericRXLV-UK!C96DF334B5ED
	AVEngine V3	GenericRXLV-UK!C96DF334B5ED
	JTI (ATP Rules)	JTI/Suspect.196612!c96df334b5ed
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
88D89E9A3EB88B44E9109185F880ECCC5ECB2ED1DF906DB25677E18EBAFF1F47	AVEngine V2	W32/PinkSbot-HC!5AA990D7864B
	AVEngine V3	W32/PinkSbot-HC!5AA990D7864B
	JTI (ATP Rules)	JTI/Suspect.196612!5aa990d7864b
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CF6FEA34AF1F1E02CFC44A685BC90C9C8C04E18A722CCF61EC73D952DF774F80	AVEngine V2	Trojan-FTJC!EE0A11ED1058
	AVEngine V3	Trojan-FTJC!EE0A11ED1058
	JTI (ATP Rules)	JTI/Suspect.196612!ee0a11ed1058
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FEC51F04710E3AAE47DD23B084D8A364FA07C25DDA5B229AEB3E6A98C56FA869	AVEngine V2	W32/PinkSbot-HC!5ED9FB5FC74C
	AVEngine V3	W32/PinkSbot-HC!5ED9FB5FC74C
	JTI (ATP Rules)	JTI/Suspect.196612!5ed9fb5fc74c
	RP Static	Real Protect-PENG4!5ED9FB5FC74C
	RP Dynamic	-

IOC	Scanner	Detection
BC358AD0917C5BF4D3ED1D552DC9D1704ADD0AF352EA357BF3DD05D4605BB2B2	AVEngine V2	W32/PinkSbot-HA!E7F7B215D292
	AVEngine V3	W32/PinkSbot-HA!E7F7B215D292
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
412ABE96CBBD685E888126581AE6485AA2038A31578FB122E38A2387400ABA0E	AVEngine V2	W32/PinkSbot-HA!8EDC802C274F
	AVEngine V3	W32/PinkSbot-HA!8EDC802C274F
	JTI (ATP Rules)	JTI/Suspect.196612!8edc802c274f
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7ABF8F3A438DF6336B84C81019E81DB57B7D98766E6897315789CE138F3C4AC3	AVEngine V2	W32/PinkSbot-HF!0A72E62E3344
	AVEngine V3	W32/PinkSbot-HF!0A72E62E3344
	JTI (ATP Rules)	JTI/Suspect.196612!0a72e62e3344
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 4 Use GTI file reputation to identify trusted or malicious files

Endpoint Security - Exploit Prevention:

Rule ID: 6086 Powershell Command Restriction - Command
Rule ID: 6135 Unmanaged Powershell Detected

Host Intrusion Prevention:

Rule ID: 6135 Unmanaged Powershell Detected

Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Virusscan Enterprise - Access Protection Rules:

Prevent creation of new executable files in the Windows folder

Host Intrusion Prevention:

Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 990 New Startup Folder Program Creation
Rule ID: 6011 Generic Application Invocation Protection
Rule ID: 1148 CMD Tool Access by a Network Aware Application
Rule ID: 910 Uninstall Registry Key Modification
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 2265 Delay Delete File Protection

Affected Products

MVISION Insights

Knowledge Center

MVISION Insights: Lockean Threat Group Targets Multiple French Sectors

Environment

Summary

Affected Products

Title

Title

Knowledge Center

MVISION Insights: Lockean Threat Group Targets Multiple French Sectors

Environment

Summary

Affected Products

Choose your region

Title

Title