Know Your Adversary

Hello everyone! I hope you are still not bored digging into ransomware gang's toolkit. This time we'll look at another defense evasion tool - WKTools .  Yes, this is another tool abused by adeversaries to terminate AV/EDR related processes. For example, it's used by Play ransomware gang ITW. Let's start from detecting the tool execution: event_type: "processcreatewin" AND (proc_file_originalfilename: "WKTools.exe" OR proc_file_description: "Windows Kernel Tools" OR proc_file_productname: "WKTools") As you may have guessed, the tool creates a driver: event_type: "filecreatewin" AND file_name: "wktools.sys" And also it deletes the driver: event_type: "filedeletewin" AND file_name: "wktools.sys" As you can see, most of the tools are really noisy, so all you need is to know where to look! See you tomorrow!

Hello everyone! Field Effect presented a report on Grixba - a notorious reconnaissance tool used by Play ransomware affiliates.  The tool allows adversaries to collect information about remote systems, installed software (including security, backup and remoste access software), browser history, processes, network, etc. An interesting thing about this version of the tool - it's designed to look like SentinelOne Compabilty Wizard! At the same time, it's not signed, and it gives us a good detection opportunity: It's not the first time Play ransomware affiliates used Grixba masquaraded like this. Trend Micro also spotted similar version of the tool during one of their incident response engagements.  Reconnaissance tools and techniques are extremely common, so it's great point to focus on to stop attacks on early stages. See you tomorrow!