Know Your Adversary

Hello everyone! I think you are aware of abusing ftp.exe for data exfiltration. But what about command execution? Cado Security Labs shared information on malicious activity attributed to Mustang Panda (we track this cluster as Horned Werewolf). In this campaign the adversary leveraged a very interesting technique -  abused ftp.exe to execute an FTP script inside the disguised PDF file: C:\Windows\System32\ftp.exe -s:"แบบตอบรับ.pdf" Of course, if you'll look for ftp.exe executions with -s parameter, you face lots of false positives (still acceptable for your threat hunting missions!), so you should focus on PDF and other file types, which are not common to contain commands or scripts: event_type: "processcreate" AND proc_file_name: "ftp.exe" AND cmdline: ("s" AND "pdf") Despite the fact the threat actors choose such creative approach, the installation routine is still quite noisy and includes, for example, dropping an executabl...

Hello everyone! Let's talk about threat hunting this time. What's the difference between threat detection and threat hunting? When you're writing detections, there must be very low false positive rate, when you're hunting, the query output should include lots of noise - it allows you to uncover threats, which we not detected. One of my favourites for threat hunting missions - rundll32.exe abuse. It's EXTREMELY common. Let's look at a recent Ghostwriter campaign described in this report by SentinelLABS. So, the adversary actively abused rundll32exe to execute malicious DLLs. Here are some procedure examples: rundll32.exe "C:\Users\<USER>\AppData\Roaming\Microsoft\bruhdll32.dll",FckUDud rundll32.exe "C:\Users\<USER>\AppData\Roaming\Microsoft\bruhdll32.dll",HelloWorld rundll32.exe "C:\Users\<USER>\AppData\Roaming\Microsoft\bruhdll32.dll",FCKU rundll32 "C:\Users\<USER>\AppData\Roaming\Microsoft\SystemCert...

Hello everyone! Recently we observed an activity cluster, which leveraged NetExec during post-exploitation. It's an open source tool for network service exploitation with LOTS of features. You can learn more about the tool here . From detection perspective it's also interesting. Today we'll cover only process creation events related to execution of the tool on the compromised system. I often tell you to look at metadata to spot renamed tools - but this time it's not the case as NetExec file doesn't have it. At the same time, it has lots of interesting command line arguments, but some of them are very noisy, so, based on my testing, here's the query: event_type: "processcreate"  AND  cmdline.keyword:/.* (smb|ldap|winrm|mssql|rdp|wmi|nfs) .*/  AND  cmdline: ("u" AND "p")  AND  cmdline:("zerologon" OR "nopac" OR "printnightmare" OR "smbghost" OR "ms17-010" OR "coerce_plus" OR ...

Hello everyone! Today we'll look at PebbleDash malware behaviors and how to detect it. This backdoor is actively used by Kimsuky (we track this activity cluster as Monolithic Werewolf). Let's look inside this  report. The adversary distributed phishing emails with EGG files attached. Not a common choice, right? That's not all. The EGG file contains a PIF file - a binary configuration file for the DOS emulator/simulator in Windows! Such files are not very common, so we can start from hunting for any executions of PIF files: event_type: "processcreate" AND  proc_file_name.keyword:/.*\.pif/ The file drops and opens a PDF file, as well as drops and executes another PIF file - PebbleDash backdoor, which abuses reg.exe for persistence in the compromised system.  Here we have a few detection opportunities. The first one - a PIF file opens a PDF file: event_type:"processcreate" AND proc_p_file_path.keyword:/.*\.pif/  AND  cmdline.keyword:/.*\.pdf/ The next one...

Hello everyone! Today we'll talk about another interesting technique - Forced Authentication (T1187). It also doesn't have many procedure examples in MITRE ATT&CK. One of the activity clusters we track, Sticky Werewolf, abuses this technique quite often. The adversary distributes phishing emails with malicious documents, which contain a resource that is automatically loaded when it is opened. Using this trick the threat actors obtain authentication material! Many documents have a very low detection rate, for example, this one . So, how can we detect or hunt for such malicious activity? We can seacrh for outbound network connections with destination port 445 (you may also add 137 and 139) originated from winword.exe or excel.exe (you can add PowerPoint): event_type: "networkconnection"  AND  net_conn_direction: "outbound"  AND  net_dst_port: "445"  AND  proc_file_path: ("winword.exe" OR "excel.exe") Of course, you may face ...

Hello everyone! I think it's not a secret that many adversaries leverage crypters to evade defenses. But some crypters not only encrypt and obfuscate maicious code, but also have intersting behaviors we can use for detection engeneering! Let's look at CypherIT - a very popular crypter, which used to be sold on underground resources, and used by lots of various threat actors worldwide (for example, Sticky Werewolf). The first behavior example we'll look at is abusing findstr for AV discovery: findstr /I "opssvc wrsa" findstr "bdservicehost AvastUI AVGUI nsWscSvc ekrn SophosHealth" To detect it, search for findstr executions with AV/EDR names in command line (you can expand this list, of course): event_type: "processcreate"  AND  proc_file_name: "findstr.exe"  AND  cmdline: (*wrsa* OR *opssvc* OR *avastui* OR *avgui* OR *nswscsvc* OR *sophoshealth* OR *bdservicehost* OR *ekrn*) Next noteworthy behavior - dropping and executing renamed A...

Hello everyone! Today we'll talk about Dead Drop Resolver sub-technique (T1102.001), and how to detect it, of course. We'll look at how ACRStealer abusing it, as seen in this report by AhnLab. So, the stealer uses three services to obtain the list of C2: Steam Telegraph Google Docs Ok, in order to detect suspicious activity, we need to find DNS requests related to this services, but not from common applications, for example, Steam, web-browsers, etc. It also depends on your EDR as some of them may not collect all DNS requests made from browsers, so you don't need to exclude it. In my case Steam has the longes list of exclusions as it includes games, VPN clients, etc (make note that browsers are excluded by default): event_type: "dnsreq"  AND dns_rname: "steamcommunity.com"  AND NOT  proc_file_path: ("steam.exe" OR "steamwebhelper.exe" OR "vrwebhelper.exe" OR "cs.exe" OR "avp.exe" OR "wire.exe" ...