SilverTerrier is a Nigerian threat group that has been seen active since 2014. SilverTerrier mainly targets organizations in high technology, higher education, and manufacturing.[1][2]
4
TechniquesBottom 13%
2
TacticsBottom 10%
5
Tools & malware60th pct
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
SilverTerrier targets organizations in high technology, higher education, and manufacturing for business email compromise (BEC) campaigns with the goal of financial theft.67
Impactno detection rules
Standing G0083
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques4Bottom 13%
13th percentile · 87% of 176 ATT&CK groups have more Enterprise techniques.
Tactics2Bottom 10%
10th percentile · 90% of 176 ATT&CK groups have more tactics spanned.
Tools & malware560th pct
60th percentile · 60% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique2medBottom 7%
7th percentile · 93% of 176 ATT&CK groups have more detection rules per technique.
Tests / technique0med
SilverTerrier detections G0083
64 distinct rules cover the 4 techniques recorded for this group. 42 Sigma · 22 Splunk.
3 covered by at least one rule1 with no coverage64 distinct rules in total
Showing 1-50 of 64 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects suspicious user agent strings used in APT malware in proxy logs
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...)
This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...)
The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...)
The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)
HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. (...)
The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. (...)
This detection identifies rapid-fire POST request attacks where an attacker sends more than 20 POST requests within a 5-second window, potentially attempting to exploit race conditions or overwhelm request handling. (...)
Detects attempts to exploit a request smuggling technique against IIS that leverages a Windows quirk where requests for reserved Windows device names such as "/con" trigger an early server response before the request body is received. (...)
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. (...)
This Splunk query analyzes web access logs to identify and categorize non-browser user agents, detecting various types of security tools, scripting languages, automation frameworks, and suspicious patterns. (...)
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. (...)