Know Your Adversary

Hello everyone! Let's look at NetExec one more time, but this time focus on forensic perspective and related artifacts. Recently the tool was used by Lynx ransomware affiliates. And according to the report , it creates multiple folders and files, which can be used both for detection and forensic analysis. Among others, it creates .nxc folder and lots of databases, for example, smb.db , rdp.db , winrm.db , etc. The databases contain the results of execution of corresponding modules, and may be a forensic goldmine! Also, searching for suspicious folders and files creation events may be a good option as well: event_type: "filecreatewin" AND file_path: ("nxc.conf" OR "ftp.db" OR "ldap.db" OR "mssql.db" OR "nfs.db" OR "rdp.db" OR "smb.db" OR "ssh.db" OR "vnc.db" OR "winrm.db" OR "wmi.db") See you tomorrow!

Hello everyone! Recently we observed an activity cluster, which leveraged NetExec during post-exploitation. It's an open source tool for network service exploitation with LOTS of features. You can learn more about the tool here . From detection perspective it's also interesting. Today we'll cover only process creation events related to execution of the tool on the compromised system. I often tell you to look at metadata to spot renamed tools - but this time it's not the case as NetExec file doesn't have it. At the same time, it has lots of interesting command line arguments, but some of them are very noisy, so, based on my testing, here's the query: event_type: "processcreate"  AND  cmdline.keyword:/.* (smb|ldap|winrm|mssql|rdp|wmi|nfs) .*/  AND  cmdline: ("u" AND "p")  AND  cmdline:("zerologon" OR "nopac" OR "printnightmare" OR "smbghost" OR "ms17-010" OR "coerce_plus" OR ...