076. Herald Werewolf: Detection Opportunities
Hello everyone! F6 released a public report on an activity cluster we track under the name Herald Werewolf (they named it Telemancon ). The activity is quite interesting, so I decide to share the report and lok at detection opportunities. The first interesting thing - the adversary drops an obfuscated PowerShell script to %userprofile%\Contacts folder and abuses the Run key for persistence. We can search for registry modification events related to the Run key with files in Contacts folder: event_type: "registryvalueset" AND reg_key_path: "CurrentVersion\\Run" AND reg_value_data: "Contacts" Another suspicious thing we can search for - PowerShell connects to telegra[.]ph : event_type: "dnsreq" AND dns_rname: "telegra.ph" AND proc_file_path: "powershell.exe" Also note interesting registry modification behaviors - they are also great candidates for hunting! See you tomorrow!