Profile picture
, 4 tweets, 6 min read
OVERRULED: Here's our take on outmaneuvering a potentially destructive adversary fireeye.com/blog/threat-re…
We talk compromise, RULER, and links to APT33.
Infosec Twitter suggests they dropped #SHAMOON 💥

Shout-out to co-authors: @QW5kcmV3 @_gackerman_ @a_tweeter_user @WylieNewmark
If you liked this part about our threat similarity engine; I have a confession: that is CYBER #machinelearning!

Designed by @BarryV & Nalani F.
Studied & prototyped by our data scientist @secbern.

Learn more here 📺: (it's not officially called APTinder)
If you like Operational Timelines, #AdversaryPursuit has you covered. We're including them in blogs because it's how we operate & it improves #threatintel sharing. Thx @QW5kcmV3

🖼️ #1: Suspected #APT33 ⏲️ fireeye.com/blog/threat-re…
🖼️ #2: Suspected #APT29 ⏲️ fireeye.com/blog/threat-re…
For anyone who stumbles on this thread about identifying the adversaries who dropped #SHAMOON, @secbern shared more details on our threat similarity engine in a new blog:
Missing some Tweet in this thread? You can try to force a refresh.

Enjoying this thread?

Keep Current with Nick Carr

Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#SHAMOON #machinelearning #AdversaryPursuit #threatintel #APT33 #APT29

More from @ItsReallyNick see all

Profile picture
Nick Carr
@ItsReallyNick
@Hexacorn @cglyer @HackingDave @DerbyCon This was a technique largely outside of my typical purview - thanks for the context @Hexacorn!

Here are some rules 📏 & in-the-wild history 📆 to share for .url persistence.

Rules: gist.github.com/itsreallynick/… (CC @cyb3rops)

A quick history on the two kinds of .URL files so far...
@Hexacorn @cglyer @HackingDave @DerbyCon @cyb3rops @QW5kcmV3 The reason for the two rules are the options
URL=file:///<local file>
*and*
URL=file://<remote resource URL>

I liked the second one more
As with all Windows scripting techniques, there are no doubt creative launch methods to replace "file://" here that are worth exploring 🤔
@Hexacorn @cglyer @HackingDave @DerbyCon @cyb3rops @QW5kcmV3 Quick history time!
(I didn't undertake a retrohunt, basing this on info at-hand)

🔍URL=file:///<local file>

At some point in ~2017 "local" .url persistence was added to commercial backdoors
Example 2017-05-03 06:07:14 (.iso dropper) virustotal.com/gui/file/8b9da…
...
Read 11 tweets
Profile picture
Nick Carr
@ItsReallyNick
#GuardrailsOfTheGalaxy
A lightweight domain check in this malicious spreadsheet references the following protected cells:

A101 = ms
A102 = build
A103 = exe
A104 = C:\Users\Public\ptedcod.xml

A100 = MSBuild payload

Shellcode calls back to RFC1918
http://10.200.23.122/dcb3
XLS upload fired on my #GuardrailsOfTheGalaxy VT hunting rules (23/58): virustotal.com/gui/file/23d13…
Note the ⏱️ guardrail
I agree with @buffaloverflow's previous comments that these are very basic implementations of #T1480 Guardrails (that expose your targets).
@buffaloverflow @MITREattack Let me connect the dots:
• @JohnLaTwC shared a sample "leav_blackboard_training.xlsm" in June 2018
• Document metadata aligns in both (Company=United States Army 😉) with different authors
• Syntax, builder (@infosecn1nja), and MSBuild payload overlaps
Read 4 tweets
Profile picture
Nick Carr
@ItsReallyNick
We're doing a special #StateOfTheHack episode this week with two of the technical experts who worked for months to graduate the activity clusters into #APT41. I'm sure @cglyer will pepper in #DFIR war stories.

If you've read the report (below),
what QUESTIONS do you still have?
I plan to go deeper on #APT41's:
1️⃣ Supply chain compromises (and nuanced attrib)
2️⃣ Linux & Windows MBR bootkits and how they were found 😉
3️⃣ Third party access 🌶️
4️⃣ Legitimate web services use (and their obsession with Steam)
+concurrent ops, overlaps!
content.fireeye.com/apt-41/rpt-apt…
@FireEye 📺 #StateOfTheHack Stream
"Double Dragon: The Spy Who Fragged Me" 🎮
#APT41 with Jackie, Ray, and @cglyer
pscp.tv/FireEye/1vAGRW…
Read 9 tweets

Related threads

Profile picture
Andrew Thompson
@QW5kcmV3
[X] State-nexus use of publicly available tools. OVERRULED.🔥
[X] For-profit threat actors expanding their modus operandi to include interactive ransomware deployment. PICK-SIX.🔥
[X] State-nexus use of social media to engage a target, circumventing email detection. HARD PASS. 🔥
fireeye.com/blog/threat-re…
fireeye.com/blog/threat-re…
Read 5 tweets
Profile picture
Andrew
@QW5kcmV3
@jfslowik invokes the OVERRULED blog during his talk about indications and warnings. The blog is a great case study for an example of winning by properly integrating technical intelligence into security operations. Great threat intelligence isn't free.
Another really great recent example of technical intelligence integrated into security operations is the Pick-Six blog fireeye.com/blog/threat-re…. #AdvancedPractices identified and attributed the the adversary's C2 server a few hours before it was used against our client.
While providing counterintelligence support to computer network defense, I quickly learned security operations are best served by close integration of intelligence professionals. Integration is critical for an effective program.
Read 3 tweets
Profile picture
Andrew
@QW5kcmV3
INFOSEC is not war. That said, I've given a bit of thought to experiences I had early in life that led to shape the way I think about security in general, not just in this space. I'm going to drop some things in here that might be disturbing for some, so mute if you're squeamish.
Early in the Iraq War, command line detonated explosives were common place. It didn't take long before we started quickly identifying and killing the trigger men, sometimes even before they stuck us. The adversary shifted to wireless detonators to increase distance.
We implemented technical countermeasures to remove that capability from the adversary. They shifted to victim detonated explosives, more commonly understood as "boobytraps". A victim had to do a thing for the thing to go off. This alone came at a cost for the adversary.
Read 15 tweets
Profile picture
Steve
@stvemillertime
Today at #S4x19, @electricfork and I debated different sides of "if OT tools and talent are needed to detect attacks on ICS." Some thoughts on ICS attacks and #TRITON in a tweep thread.
For the debate, I'm not convinced either way because there are few *public* intrusion data sets for either side of the argument. I think peeps are over it now, maybe no point to sharing this, but to get the convo started let's dump/share some rando #TRITON #TRISIS TTPs.
.@FireEye blogged/presented about #TRITON and some of the incident response activities in depth by @voteblake and friends in late 2017, fireeye.com/blog/threat-re… and
Read 25 tweets
Profile picture
Christopher Glyer
@cglyer
Long rumored @TheJusticeDept indictment of #APT10 is out. sc.cnbcfm.com/applications/c…
Here are my observations/highlights from reading the indictment (channeling my inner @pwnallthethings):
-the indictment indicates #APT10 operations started in 2006 and went through 2018. The 2006 activity was likely focused on US Government, Military, and defense contractors

1/n
Interestingly the indictment calls out multiple government organizations by name that were victims including:
@NASAGoddard, @NASAJPL, @LLNL, and the @USNavy

2/n
Read 24 tweets
Profile picture
Esfandyar Batmanghelidj
@yarbatman
1. A couple things that stick out about @FireEye's announcement regarding the discovery of an Iranian “influence operation” across websites, Facebook, and Twitter. This doesn't look like an Internet Research Agency type operation.
fireeye.com/blog/threat-re…
2. Let’s start with one of the primary websites identified as part of the network. Instituto Manquehue. You can check it out here: institutomanquehue.org
3. It is a weird site that is clearly trying to look legitimate. But it doesn’t seem inherently “fake.” The institute appears to have been around since 2014 offering a leftist vision for Latin American journalism free from the “foreign influences of West and East.”
Read 30 tweets

Trending hashtags

#AdversaryPursuit #SOS #TriggerAConservativeIn2Words #IndivisibleTimes #EmbraceUnity #CBS #Leftist #TPUSA #HRC #FBI #Traitors #DanCoats #FakeNews #Dems #NK #Phoenix #USA #DSMeadia #Tarmac #trashtics #Twitter #Jack #Zuckerberg #BerkeleyAntifa #Resistance
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!