FortiGuard Outbreak Alert: Androxgh0st Malware Attack

[kcheung]

Description	This article describes the Androxgh0st Attack coverage with FortiNDR Cloud. Androxgh0st is a info-stealing malware exploiting the Laravel Framework (CVE-2018-15133) to spread and conduct information gathering attacks on the target networks
CVE ID	CVE-2018-15133 (https://nvd.nist.gov/vuln/detail/cve-2018-15133)
NDR Cloud Detection Rule	Detection Rule Name Category Primary MITRE ID FortiGuard Outbreak Alert: AndroxGh0st Malware HTTP POST Request Attack: Command and Control T1071 - Application Layer Protocol FortiGuard Outbreak Alert: CVE-2018-15133 Laravel Framework Unserialize RCE HTTP POST Request Attack: Exploitation T1190 - Exploit Public-Facing Application
Threat hunting	FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for “Androxgh0st” related activities. https://www.fortiguard.com/outbreak-ioc?tag=Androxgh0st%20Malware
Suricata Coverage	N/A
Other Fortinet Products	For more details regarding mitigating the vulnerability by utilizing Fortinet products, please refer to https://www.fortiguard.com/outbreak-alert/androxgh0st-malware