/2 The TA used the leaked credentials from an employee of the company to connect to the internal network via Citrix Netscaler.
Using the Velociraptor @velocidex Hunt Windows.EventLogs.RDPAuth, we first gather logon data from the systems in our network. Below the description.
3/ Although the hunt says in the description "Best use of this artifact is to collect RDP and Authentication events around a timeframe of interest" this Velo-Search can also be used wonderfully for generic hunting.
4/ Next, we evaluate the source IP from where the users log into the network.
Through automated (geo-lookups) or comparison with threat lists, potentially hacked accounts could be identified.
In this case, however, we knew the compromised user, which simplified the analysis.
5/ The IP address from the RDP log on is listed on Shodan with an exposed RDP port - very likely a hacked server that is now being used for further activities by attackers.
The hostname "WIN-799RI0TSTOF" is interesting.
6/ @BushidoToken talked about the analysis of workstation names before:
8/ With these workstation names, it is now possible to hunt very specifically in the (security) logs or to set up alarms if this hostnames appears somewhere in the internal network.
AnyDesk
Splashtop
Atera
TeamViewer
SupRemo
ScreenConnect
Remote Utilities
After breaching a network, attackers install, besides the obvious backdoors, other (legitimate) remote desktop products that can be used to re-enter the network. 🧵
2/ The list above is not exhaustive, but defenders and incident responders must make sure that the installed remote desktop products were installed by the customer and not by an attacker.
3/ Especially in the case of an IR investigation, it is imperative to hunt for these products in the network.
But also proactively during a compromise assessment - the credentials for the remote solution could also have been leaked on a private PC (-> if possible, use MFA).
1/ @CISAgov published the 2021 Top Routinely Exploited Vulnerabilities.
We also had another IR case not too long ago where the attackers connected via Forti-VPN where the credentials for that account were in the big credentials leak - in 2022! 🤯
The credentials were (potentially) obtained from systems that remained unpatched against CVE-2018-13379 at the time of the actor's scan. Even if the devices have since been patched, they remain vulnerable if the passwords are not reset. 🚨
3/ Actually, this should have been done a loooooong time ago, but companies should check (or have checked) whether credentials from their users are present in this leak.
And (or) change all users' passwords if necessary, together with a review of the VPN configuration.
2/ exiftool works very well to find out the path and command line arguments of the malicious LNK file:
3/ The analyzed sample from @Netskope calls PowerShell directly. However, in our sample, cmd.exe is called first, then PowerShell with a base64 encoded command argument.
2/ The TA deployed the C2 agent "on opaque network appliances within the victim environment; think backdoors on SAN arrays, load balancers, and wireless access point controllers. These kinds of devices don’t support antivirus or endpoint detection and response tools (EDRs),
3/ subsequently leaving the underlying operating systems to vendors to manage."
The C2 agent on the compromised servers and systems uses DynDNS domains to communicate with the C2 server.
The use of an internal DNS server, which also logs the DNS queries over an extended
1/ #ThreatHunting: @SentinelOne blogged about a Chinese TA called Moshen Dragon that uses password filters to read plaintext passwords (when they are changed).