Know Your Adversary

Hello everyone! How often do you use proxy logs for threat hunting? I hope often enough as C2 communications may involve accessing quite interesting URLs. Let's look at a few examples! The first one is related to an activity cluster we track as Watch Wolf . If you look at the example, you can see that the malware accesses the following URL: hxxps://4ad74aab[.]cfd/index.php Of course, even the domain itself is quite suspicious, including the TLD, but the URL also contains " index.php ", so we can use both to create a hunting query. Another example - Rhadamanthys . And another suspicious URL, of course: hxxps://193.84.71[.]81/gateway/wcm6paht.htbq1 Here we also have an interesting part for building a hunting query - " gateway ".  See you tomorrow!

Hello everyone! How are your threat hunting missions going? Let's talk about DarkWatchman - a RAT leveraged by an activity cluster we track as Watch Wolf . So, let's use it to generate a threat hunting hypothesis. Let's focus on the following behavior: wscript.exe "C:\Users\user\AppData\Local\c784477d0.js" 188 As you can see, it abuses wscript.exe to execute a malicious JS-script located in the specific folder. So, we can hunt for suspicious JS-scripts executed from the same folder or subfolders: event_type: "processcreatewin" AND proc_file_name: "wscript.exe" AND cmdline: "AppData\\Local" AND "js" If you want to learn more about this RAT's behaviours - here's a sample for you. See you tomorrow!