179. Hunting for Ladon

Hello everyone!

Today we'll talk about a framework, which is quite popular among Chinese-speaking threat actors. It's called Ladon and can be used by adversary to solve various tasks: scanning, exploitation, remote execution, etc.

It's used in-the-wild. Here're some procedure examples as seen in this report:

powershell -exec bypass Import-Module .\Ladon.ps1;Ladon SweetPotato whoami

powershell -ExecutionPolicy Bypass Import-Module .\Ladon.ps1;Ladon MssqlCmd [IP] [User] [Password] master xp_cmdshell “net user”

So, if a threat actor uses it on a compromised system, you see LOTS of interesting command line arguments, and we can use it for detection and hunting:

event_type: ("processcreatewin" OR "processcreatemac" OR "processcreatenix") AND cmdline: ("ladon" OR "ms17010" OR "bypassedr" OR "whatcms" OR "draytekpoc" OR "debase64" OR "smbghost" OR "enummssql" OR "enumshare" OR "ldapinfo" OR "ftpinfo" OR "smbscan" OR "wmiscan" OR "ldapscan" OR "winrmscan" OR "smbhashscan" OR "wmihashscan" OR "sshscan" OR "mssqlscan" OR "oraclescan" OR "weblogicscan" OR "vncscan" OR "ftpscan" OR "tomcatscan" OR "httpbasicscan" OR "nbtscan" OR "winrmscan" OR "dvrscan" OR "weblogicpoc" OR "phpstudypoc" OR "activemqpoc" OR "tomcatpoc" OR "struts2poc" OR "weblogicexp" OR "tomcatexp" OR "zerologon" OR "ftpsniffer" OR "httpsniffer" OR "iispwd" OR "wifipwd" OR "filezillapwd" OR "dumplsass" OR "wmiexec" OR "smbexec" OR "atexec" OR "sshexec" OR "jspshell" OR "webshell" OR "winrmexec" OR "bypassuac" OR "printnightmare" OR "spoolfool" OR "ms16135" OR "badpotato" OR "sweetpotato" OR "efspotato" OR "powercat" OR "regauto" OR "rdphijack" OR "logdeltomcat" OR "printerpoc" OR "xshellpwd" OR "msnswitchpwd" OR "netgearpwd" OR "joomlapwd" OR "godpotato" OR "hikvisionpoc" OR "bypassav" OR "mcppotato" OR "rubeus" OR "sharpgpoabuse" OR "mmcexec" OR "shellbrowserexec" OR "pvefindaduser")

See you tomorrow!

Comments

Post a Comment

Popular posts from this blog

391. Hunting for TeamPCP's Stealer

Image
Hello everyone! What do I know about stealers? They seem to be very noisy! And today, we’ll once again see that in action using TeamPCP (Haze Wolf) as an example. This time , the stealer was implanted by attackers into three versions of the xinference package (2.6.0, 2.6.1, and 2.6.2). Essentially, it collects SSH keys, various credentials, environment variables, crypto wallets, and much more, then uses cURL for exfiltration. Let’s take a look at a couple of techniques the attackers used to obtain credentials. For example, they were interested in data stored in environment variables: env | grep AWS_ env | grep -i google env | grep -i gcloud env | grep -i azure This looks fairly suspicious from a detection perspective: event_type: processcreate* AND proc_file_path: "env" AND cmdline: ("grep" AND ("aws_" OR "google" OR "azure" OR "gcloud")) Another technique was abusing kubectl to obtain credentials: kubectl get secrets --all-n...
Read more

343. Ransomware Gangs Abuse SystemSettingsAdminFlows to Evade Defenses

Image
Hello everyone! Today we'll look at another example of how adversaries abuse legitimate Windows executables to evade defenses. This time it's  SystemSettingsAdminFlows.exe . According to this report , DeadLock leveraged this utility to disable various features of Windows Defender: SystemSettingsAdminFlows.exe Defender RTP 1  SystemSettingsAdminFlows.exe Defender SpynetReporting 0  SystemSettingsAdminFlows.exe Defender SubmitSamplesConsent 0  SystemSettingsAdminFlows.exe Defender DisableEnhancedNotifications 1 The commands disable Real-Time Protection (RTP) and cloud-based protections, stops the machine from sending threat reports to Microsoft, and prevent Windows Defender from automatically submitting suspicious files for analysis. Worth a query, isn't it? event_type: "processcreatewin" AND proc_file_path: "systemsettingsadminflows.exe" AND cmdline: "defender" See you tomorrow!
Read more

324. Adversaries Use HideMouse to Hide Evidence of Remote Access

Image
Hello everyone! We are often talking about how adversaries abuse RMMs, so let's talk a bit about a curious case of how they hide evidence of remote access. According to this report , the threat actors used HideMouse - an utility, which allows to hide mouse cursor movement, so the can use ScreenConnect they installed previously. Another hunting (or even detection!) opportunity, right? event_type: "processcreatewin" AND proc_file_productname: "HideMouse" See you tomorrow!
Read more