Updates to the pack during the beta phase might include non-backward compatible features. Since the playbook is beta, it might contain bugs. Note: This is a beta playbook, which lets you implement and test pre-release software. Kaseya Incident Overview & Technical Details Mitigation using Kaseya On-Premises and SaaS patch.Provide advanced hunting and detection capabilities.Block indicators automatically or manually.Search for internet facing Kaseya VSA servers using Xpanse.QRadar query is done using Reference Set and 'QRadar Indicator Hunting V2' playbook.

Splunk advanced queries can be modified through the playbook inputs.Indicators, PS commands, Registry changes and known HTTP requests hunting using PAN-OS, Cortex XDR and SIEM products.

Collect related known indicators from several sources.

This playbook should be trigger manually and includes the following tasks: This allowed the attacker to deploy ransomware on Kaseya customers' endpoints. Kaseya customers pointed out a ransomware outbreak in their environments.įurther investigation revealed that REvil group exploited VSA zero-day vulnerabilities for authentication bypass and arbitrary command execution. On July 2nd, Kaseya company has experienced an attack against the VSA (Virtual System/Server Administrator) product. Supported Cortex XSOAR versions: 6.0.0 and later.

Remove kaseya agent manually