Share this page!

Steve Miller Profile picture
Twitter logo
28 Jan, 6 tweets, 2 min read
#ConventionEngine: Part Cinq - OLE Edition

ConventionEngine is *mostly* about PDBs, directory paths that reflect something about the original code project and development environment. The paths are the signal. Where else will they show up? Why, in OLE objects! Let's explore...
We had a revelation that seeing an RTF with an OLE is not that crazy, but when that inside OLE has, for whatever reason, a full directory path, the whole object becomes so much more interesting. For example, RTF with OLE with C:\Users\ in it. Let's use Yara to take a measurement.
Here's a quick #dailyyara rule looking for RTFs with OLE objects with a path of C:\Users\ in it...somewhere...for some reason. This is odd, and unsurprisingly super threat dense.

gist.github.com/stvemillertime… Image
The Convention for RTF OLEs with C:\Users\ path shows up rel to many malware families:

fireshadow
coldpot
badflick
woodslice
icefog
darkcheese
graphraft
redhawk
gingeryum
clubhouse
sodariver
wordmopper
sourdrop
doublepipe
dadstache
hawkball
bustedroad

& rel to several CVEs too
Convention for RTF OLEs with C:\Users\ ...by which threat groups?

unc1890
unc2155
unc1608
unc229
unc1611
apt40.izzy
unc1819
unc1986
unc1614
unc1352
unc2361
unc1687
unc1432
unc1077
unc1987
unc1449
unc1575
unc1036
unc2082
What other ConventionEngine rules might be good? I imagine anything with *a* directory path in an OLE would be good, and beyond RTFs maybe we apply this to OOXML as well. I will continue to survey and experiment. Join the fun!

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Steve Miller

Steve Miller Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @stvemillertime

Steve Miller Profile picture
21 Jan
How do @Mandiant UNC clusters get formed, merged, and graduate to APT groups or even personas? Look at serial crimes and sprees in meatspace. Multiple crimes on multiple victim systems, multiple places. It takes forensic evidence to tie the cases together. It's the same process.
Foot impression from the crime scene. Is it unique? What shoe is it, where was it sold? How many made in that size? You have to know if the evidence is unique. All the casings, latents, entry toolmarks. Technical evidence is how we group crimes together and move towards an actor.
TTPs and MOs and methodologies and victimologies are important too, but these don't help you get attribution alone. Technical links, grounded in substantiated evidence is the only way.
Read 16 tweets
Steve Miller Profile picture
14 Oct 20
Students of #infosec: @Mandiant and @FireEye folks have put out tons of blogs over the years. Careful reading of these can help you build familiarity with threat actors, intrusion TTPs, and threat data. And sometimes they're just fun. Here's a thread with some of my favorites:
FIN7 related

LNKs
fireeye.com/blog/threat-re…

SDB persistence
fireeye.com/blog/threat-re…

RDFsniffer
fireeye.com/blog/threat-re…

CARBANAK
fireeye.com/blog/threat-re…
ICS/OT related...

TRITON
fireeye.com/blog/threat-re…

unc878
fireeye.com/blog/threat-re…

IT/OT strategies
fireeye.com/blog/threat-re…

Triton and TriStation
fireeye.com/blog/threat-re…
Read 10 tweets
Steve Miller Profile picture
20 Mar 20
ExportEngine: Find Evil by PE Export DLL Names

(a #dailyyara thread)

PE files w/ exported functions often contain an image directory entry that we usually call something like "PE DLL name" or "export DLL name"

This string is "analytically rich" and is surfaced in many tools
Here in a sample of EVILTOSS (APT29) we see lots of valuable metadata in the IMAGE_EXPORT_DIRECTORY but it also contains the plain-as-day export DLL name "install_com_x32_as_dll.exe"
The export DLL name strings contains enough predictable developer conventions that you can use simple Yara rules to surface, cluster, detect/hunt for malicious activity that might otherwise be missed (similar to my prior research on ConventionEngine and PDB paths). Let's look...
Read 16 tweets
Steve Miller Profile picture
22 Feb 20
You may not think attribution matters, but I think attribution is also on the detection spectrum, or #DETECTRUM. I'm trying to think about it as layers of additive traps that enable us to hedge our bets for visibility, resilience in detection, sometimes to figure out who dun it.
I think the #DETECTRUM can be used to model both inputs and outputs of the detection engineering process - whether you're plotting "logic designed to find evil," alerts, the tech, or the or the data itself. The graphs might look a bit different, but same ideology might be useful
See also this thread and this thread:



and there's plenty of commentary on the #detectrum as well

Read 4 tweets
Steve Miller Profile picture
26 Feb 19
The basis for #SwearEngine is that malware developers are developers too. The catharses in their malware code manifest in a multitude of coarse expressions. Thus we can use the presence of swear words as a "weak signal" to surface interesting files. #threathunting
You may balk at #SwearEngine for being #basic but consider that this rule, looking for PEs with one single "fuck", detects malware samples used by APT5, APT10, APT18, APT22, APT26, Turla, FIN groups, dozens of UNC espionage clusters. Too many to list.
At least one single "fuck" is present in some samples of the following malware families: AGENTBTZ, ASCENTOR, ZXSHELL, SOGU, TRICKBOT, GHOST, VIPER, WANNACRY, WARP, NETWIRE, COREBOT, REMCOS, VIPER, ORCUSRAT, PONY, etc. I can't even name the coolest ones. There are hundreds.
Read 6 tweets
Steve Miller Profile picture
19 Feb 19
Hopefully the 2019 @CrowdStrike “heat map” and global prevalence of @MITREattack will set a precedent for how vendors publicly discuss TTPs, allowing defenders to prioritize detection efforts based on evidence rather than cool factor: crowdstrike.lookbookhq.com/web-global-thr…
The @CrowdStrike report does not discuss the biases nor provide real hard numbers on the TTPs, which I know from experience are hard to deduplicate on intrusions (some are over represented and some are under represented). Maybe @_devonkerr_ or someone can shed some light here.
I’d like for someone to explain how data was collected, where the gaps are, and how the global prevalence (GP) measurements vary w/r/t malware families, actor groups, fluctuating GP for TTPs over the last couple of years. What is rising and falling? What can’t @CrowdStrike see?
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @stvemillertime has new unrolls!

Check out other threads from @stvemillertime!

Read all threads by @stvemillertime