3/ The installer creates two scheduled tasks for the 32-bit and the 64-bit r77 service, according to the GitHub Readme.
After running the installer on our lab system, no new scheduled task is visible inside the Tasks folder.
4/ But if we use the MFT-Hunt of @velocidex and search for the keyword $77 in the MFT, we get two hits!
5/ Now that we have the MFT EntryNumber of the Scheduled Task created by the rootkit installer, we can export the task file with Velociraptor (NTFS.Recover).
6/ After exporting the scheduled task, we see that the job is running obfuscated PowerShell code.
So one technique to find this rootkit is to parse the MFT for keywords like "$77".
7/ The R77 test console shows that named pipes are used for communication (with the pipe name "$77control").
8/ We can now search specifically for this pipe name in memory (with the Velociraptor Hunt Yara.PhysicalMemory)
9/ This search also returns various hits indicating that the system is infected with R77.
10/ Although this rootkit hides its presence with various techniques, it is relatively easy to find out if a system is infected with R77, as the two examples with the MFT and the NamedPipes have shown. 😎
• • •
Missing some Tweet in this thread? You can try to
force a refresh
1/ We recently had an interesting #Azure case where the TA, instead of creating a new Inbox Rule, added email addresses of interest to the list of blocked senders and domains.
The incoming emails will get flagged as spam and moved to the Junk email folder. 📂
🧵
2/ Here is a screenshot from Outlook web access
(the view might differ, as, for example, here on the screenshot from the theitbros [1])
1/ Customer receives an email from a network monitoring device that a host is supposedly infected with a #CoinMiner. The Task Manager on the said system shows the following screenshot 🤕.
A story of an unpatched system, incorrect scoping, and 🍀. 🧵
1/ I used #AutoRuns v14.09 (GUI) in my lab setup but noticed that it failed to find (or display) the malware in the Startup folder, although the file is there (screenshot below).
I checked back and forth, searched manually for the file, and restarted the OS and AutoRuns.
🧵
2/ With #Velociraptor, I ran the hunt Sysinternals.Autoruns, and with the CLI version of AutoRuns, the malware is found in the Startup folder.
3/ The same for the #Velociraptor hunt Sys.StartupItems.
1/ Real-World #PingCastle Finding #13: Allow log on locally
➡️ Domain Users are eligible to log into DC's 🤯🙈
"When you grant an account the Allow logon locally right, you are allowing that account to log on locally to all domain controllers in the domain." [1]
"If you do not restrict this user right to legitimate users who must log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges." [1]
3/ I encountered this finding several times in our AD assessments, so you better check your settings in your domain right now (better safe than sorry 🔒).