179. Hunting for Ladon
Hello everyone! Today we'll talk about a framework, which is quite popular among Chinese-speaking threat actors. It's called Ladon and can be used by adversary to solve various tasks: scanning, exploitation, remote execution, etc. It's used in-the-wild. Here're some procedure examples as seen in this report : powershell -exec bypass Import-Module .\Ladon.ps1;Ladon SweetPotato whoami powershell -ExecutionPolicy Bypass Import-Module .\Ladon.ps1;Ladon MssqlCmd [IP] [User] [Password] master xp_cmdshell “net user” So, if a threat actor uses it on a compromised system, you see LOTS of interesting command line arguments, and we can use it for detection and hunting: event_type: ("processcreatewin" OR "processcreatemac" OR "processcreatenix") AND cmdline: ("ladon" OR "ms17010" OR "bypassedr" OR "whatcms" OR "draytekpoc" OR "debase64" OR "smbghost" OR "enummssql" OR ...