{
  "Name": "Zinc Open Source",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
  "Description": "Microsoft security research teams have detected a wide range of social engineering campaigns using weaponized legitimate open-source software by an actor tracked as ZINC.  ZINC employed traditional social engineering tactics by initially connecting with individuals on LinkedIn, followed by communication over WhatsApp, which acted as the means of delivery for their malicious payloads. ZINC was found weaponizing a wide range of open-source software including PuTTY, KiTTY, TightVNC, Sumatra PDF Reader etc. For more technical and in-depth information about the attack, please read the [Microsoft Security blog post](https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/).This solution provides content to detect and investigate signals related to the attack in Microsoft Sentinel.\n\n**Pre-requisites:**\n\nThis is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution.\n\n  1.Windows Security Events\n\n  2.Microsoft Defender XDR\n\n  3.Windows Server DNS\n\n  4.F5 Advanced WAF\n\n  5.Cisco ASA\n\n  6.Palo Alto Networks\n\n  7.Common Event Format\n\n  8.Fortinet FortiGate\n\n  9.Check Point\n\n  10.Microsoft 365\n\n  11.Azure Firewall\n\n  12.Microsoft Windows Firewall\n\n  13.Windows Forwarded Events\n\n**Keywords:** Zinc, Open Source, ZetaNile , Putty, Kitty, TightVNC , EventHorizon, FoggyBrass, PhantomStar, threat actor, Adversary.",
  "Analytic Rules": [
    "Analytic Rules/ZincOctober2022_AVHits_IOC.yaml",
    "Analytic Rules/ZincOctober2022_Filename_Commandline_IOC.yaml",
    "Analytic Rules/ZincOctober2022_IP_Domain_Hash_IOC.yaml"
  ],
  "dependentDomainSolutionIds": [
    "azuresentinel.azure-sentinel-solution-securityevents",
    "azuresentinel.azure-sentinel-solution-microsoft365defender",
    "azuresentinel.azure-sentinel-solution-dns",
    "f5-networks.f5_bigip_mss",
    "azuresentinel.azure-sentinel-solution-ciscoasa",
    "azuresentinel.azure-sentinel-solution-paloaltopanos",
    "azuresentinel.azure-sentinel-solution-commoneventformat",
    "azuresentinel.azure-sentinel-solution-fortinetfortigate",
    "checkpoint.checkpoint-sentinel-solutions",
    "azuresentinel.azure-sentinel-solution-office365",
    "sentinel4azurefirewall.sentinel4azurefirewall",
    "azuresentinel.azure-sentinel-solution-windowsfirewall",
    "azuresentinel.azure-sentinel-solution-windowsforwardedevents"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Zinc Open Source",
  "Version": "3.0.3",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true
}