Know Your Adversary

Hello everyone! Today we'll look at another interesting example of the following technique:  Remote Access Tools (T1219) . Scrolling the report on Handala Hack modus operandi, I've spotted an interesting tool abused by the threat actors. I'm talking about NetBird .  The attackers leveraged it to reach hosts that were not directly accessible from outside the network. The tool has no detections on VirusTotal, and may be a good target for hunting, for example: event_type: "processcreatewin" AND proc_file_productname: "netbird" See you soon!

Hello everyone! We already talked about abusing forensic and incident response tools. Let's look at a curious example of how adversaries leverage such software instead of Remote Access Tools (T1219) . According to Sophos report , an adversary leveraged  Velociraptor , which was configured to communicate with C2 server velo[.]qaubctgg[.]workers[.]dev .  Yes, you may even use Velociraptor in your environment, but it's unlikely be configured to communicate with workers[.]dev domains. And we can use it to build the query: event_type: "dnsreqwin" AND dns_rname: "workers.dev" AND proc_file_path: "velociraptor.exe" See you tomorrow!