Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.[1]
26
TechniquesTop 23%
12
TacticsTop 14%
0
Tools & malwareNone recorded
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Leviathan Australian Intrusions MITRE reference C0049
Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions.6
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques26Top 23%
77th percentile · 77% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics12Top 14%
86th percentile · 86% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware0Bottom 11%
11th percentile · 89% of 56 ATT&CK campaigns have more tools and malware.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique17med59th pct
59th percentile · 59% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique2med
Leviathan Australian Intrusions detections C0049
820 distinct rules cover the 26 techniques recorded for this campaign. 474 Sigma · 346 Splunk.
22 covered by at least one rule4 with no coverage820 distinct rules in total
The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)
Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
2022-08-11
2022-08-18
6f583da0-3a90-4566-a4ed-83c09fe18bbf
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-01
—
248649b7-d64f-46f0-9fb2-a52774166fb5
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. (...)
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
2023-09-07
—
a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
Splunk
The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. (...)
The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. (...)