Stories from the SOC - Unveiling the stealthy tactics of Aukill malware

Executive summary

On April 21st, 2023, AT&T Managed Extended Detection and Response (MXDR) investigated an attempted ransomware attack on one of our clients, a home improvement business. The investigation revealed the attacker used AuKill malware on the client's print server to disable the server's installed EDR solution, SentinelOne, by brute forcing an administrator account and downgrading a driver to a vulnerable version.

AuKill, first identified by Sophos X-Ops researchers in June 2021, is a sophisticated malware designed to target and …

amp april attack business client clients detection detection and response edr executive extended detection extended detection and response home improvement investigation malware managed managed extended detection and response print ransomware ransomware attack response sentinelone server soc solution stories tactics