Blu3_Team

Hunting startup events can be tricky but rewarding. There are a lot of events which makes filtering difficult and there are some tricks to isolating the data. One way is to look at the registry keys and directories being written too but for hunting I assume that there are some past events that were missed. Here is a method of profiling the events at run time. For events from currentversion/run or start menu events the parent will be explorer.exe and the grandparent will be userinit.exe . But, they need to occur in a smallish time from after userinit executes. This example is limiting the results to keywords .vbs .wsf .bat, but we can look for all sorts of interesting things, hta files, powershell, temp directory, etc. Run key or Start Menu  .vbs .wsf .bat index=edr procstart ( userinit.exe explorer.exe parent_path=*\\userinit.exe ) OR ( explorer.exe parent_path=*\\explorer.exe ( .vbs OR .wsf OR .bat ) NOT ( [put filters here] )) | bucket _time span=5m | stats values(c...

Nice find by @Hexacorn on " SettingSyncHost.exe as a LolBin ". Knowing that gatherNetworkInfo.vbs had some of the same characteristics I checked it using @Hexacorn's methodology and it works great. Just rename your binary in the current working directory and trigger. I was also able to get this to work in other user writable directories so it is not just limited to TEMP. c:\windows\system32\cscript.exe c:\windows\system32\gatherNetworkInfo.vbs I don't think this is the full list of programs called but it should be most of them. reg.exe sc.exe wevtutil.exe arp.exe certutil.exe route.exe net.exe Detection Identifying a true positive for these might be tricky, not because a signature is difficult, but because even if it triggers the main indicator is not command line artifacts (which are normal) but the process path itself. A while back I did a post on detecting System32 executable from non-standard paths which would work for these occurrences. It t...

I have done a couple of posts concerning detecting C2 activity and calculating duration of processes from Carbon Black data in Splunk. In this post I'll show a method of combining the two to detect network connections only from long running processes. This hunt targets script processes which can be a backdoor in themselves but are usually pretty noisy in the enterprise. This also helps close a detection gap in the way that Carbon Black logs are presented. If a single process makes a long running C2 connection the only events seen are the procstart and procend. Within those two events any amount of data can be sent and received. The term "long running" is arbitrary, after experimenting,  I moved the time down to 5 seconds since it was easily filtered and pretty quiet. This makes sense when you think about it, there should not be many scripts that run for minutes at a time that make external network connections. Lets start with a profiling search to find long runnin...

Mixed case obfuscation is a good technique if security appliances are case sensitive and a wash if they aren't. But looking at "PoWERsheLL -e"  you know its bad so lets do a quick signature for the case obfuscation to add to our other powershell detections. Of course this ONLY detects the mixed case but this is a valid TTP as it is seen in the wild. First you will need to profile the existing common case occurrences for your network. Turned out I see just a couple of common ones which will become our filter. Profile search index=edr powershell command_line=*powershell* | rex field=command_line "(?i)(? powershell)" | stats count by case_sensitive_string So (?i) to do a case insensitive match for powershell and stats does its normal case sensitive aggregation. Hopefully at this point you have a small filter list. Now for the real search index=edr powershell command_line=*powershell* | regex command_line!="(POWERSHELL|powershell) | table comm...

If you already have powershell event logs in Splunk and want to decode the base64, this may help. This tutorial builds on the work of others with some new cleverness to provide an efficient decoding of powershell commands for threat hunting. After adding the Splunk Decrypt addon #2655 to decode powershell encoded scripts I ran into a problem. Namely that the app decodes the powershell fine but removing the null padding (seen as periods) took me a while to figure out. TL;DR  Here is the sig index=edr powershell.exe process=powershell.exe command_line!="" ( command_line="* -en*" OR command_line="* -e *" ) NOT ( -Enable* OR -Encoding ) | rex field=command_line "(?i)-en?c?o?d?e?d?c?o?m?m?a?n?d?\s('|\")?(? [\w/+]{16,3920}\=?\=?)('|\")?" | decrypt field=base64_command atob hex emit('base64_decoded_hex') | rex mode=sed field=base64_decoded_hex "s/([0-9A-Fa-f]{2})00/%\1/g" | eval base64_decoded_command=urldec...

This was a great share by @subtee about misleading directory names and worthy of a quick sig. I needed a few more tunes than shown but this is the general idea. Evasive program files directory name   index=edr program process_path=c:\\program* process_path!="c:\\program files\\*" process_path!="c:\\program files (x86)\\*" process_path!=c:\\programdata\\* | table process_path md5 command_line parent_path I add the md5 to the table for quick review if I get any hits. References: https://twitter.com/subTee/status/1187037543260274688

Screen saver files have a small filterable list of normal parents that can expose malicious scr files during execution. https://twitter.com/Timele9527/status/1186816375857139712 https://app.any.run/tasks/e076b4a8-abfb-41a1-b7b5-3eadced93192/ #APT #TransparentTribe SCR from unusual parent index=edr scr process=*.scr process_path!=*\\windows\\syswow64\\* process_path!=*\\windows\\system32\\* parent_process!=*\\winlogon.exe | table process_path md5 parent_path command_line References: https://twitter.com/Timele9527/status/1186816375857139712 https://app.any.run/tasks/e076b4a8-abfb-41a1-b7b5-3eadced93192/

Sample: https://app.any.run/tasks/455f13a6-c615-4969-bbfb-50967760b158/ Here is a nice sample of #adwind using a few child processes (cmd, xcopy, reg, attrib, and javaw) that we can use as a cluster TTP.  In addition, the malware is impatient so it does all this in a few seconds as well, which will help isolate the behavior when searching over long time frames. Here is the search minus a couple of tunes I needed: index=edr java.exe parent_path=*\\java.exe ((cmd.exe cscript.exe) OR (reg.exe add) OR taskkill.exe OR attrib.exe OR xcopy.exe )    | bucket _time span=1m    | stats values(command_line) dc(command_line) as command_count values(process) dc(process) as proc_count count by computer_name _time    | where command_count>2 AND proc_count>2 Breakdown: The parent must be java.exe The bucket sets the one minute time frame for the events Command_count gives us the unique event count for command lines Proc_count gives us the distinct count of the process names since w...

One of the TTPs for #Ursnif samples has been to use WMI classes to launch powershell.  This shows in the EDR as wmiprvse.exe as the parent of the malicious powershell process but it is not evident what initiated the process since the parent child relationship has been broken.  You probably already have a signature for the wmiprvse.exe as parent to powershell and the Word file containing the macro uses a detectable name format "info_10_1.doc".  It would be nice to fill in the attack chain a bit to speed up the analysis process. One interesting method is to use the proximity of the winword.exe startup event to the wmiprvse.exe parent event.  This might seem like a good place for a Splunk transaction but I find them slow at times so I tend to use the Stats command where possible. Detect Wmiprvse.exe as parent in close proximity to Winword.exe starting index=edr procstart ( winword.exe OR wmiprvse.exe ) (process=winword.exe OR parent_path=*\\wmiprvse.exe) | ...

Right now your enterprise network with all its users and systems is a live production lab for any malware or attacker that comes along. If you have an EDR you have an advantageous view of the the endpoints. How about installing that same EDR on your malware analysis system so you can review signatures and TTPs from malware in a controlled environment? You'll be surprised the difference it makes in finding new TTPs. I have always felt it would be nice to be able to allow some traffic out of a dynamic malware analysis lab without letting it all out. As a rule I don't allow malware to talk directly to the Internet without a very good reason to do so. Now with EDR technology available it became crucial to allow the EDR to be able to connect to the mothership while restricting all other traffic to the host only malware network. But once this is setup we can expand things a bit and allow api.ipify.org and other benign traffic. Here is how I did it. If you have a different way I ...

I recently took a look at Powershell DNS C2 and found a couple of interesting things. The special case of DNS requests from powershell should be easy enough to identify using an EDR. Using splunk and stats just look for multiple remote port 53 occurrances from powershell. There will be a few but DNS c2 is noisy so a large limit can be used for filtering. Next I took a look at DNSCat https://github.com/lukebaggett/dnscat2-powershell Interestingly powershell does not make the dns request directly but spawns nslookup to do it. Easy enough to make a signature for that. Again, powershell calling nslookup will occur legitimately, but a large filter for occurrences will filter those out. index=edr powershell.exe nslookup.exe parent_path=*\\powershell.exe | stats values(command_line) count by computer_name parent_process_guid | where count>10 Next I went back to some old Oilrig samples which used DNS C2. Nothing new here, just multiple DNS requests directly from powershell. B...

https://www.vkremez.com/2018/04/lets-learn-trickbot-implements-network.html Vitali and others have noted that trickbot is running reconn commands. I finally saw them in action and these happen to be children of svchost so I did a quick sig and it looks pretty reliable and quiet. Nothing fancy, just looking for cmd.exe as a child of svchost.exe with common reconn command lines. index=edr svchost.exe process_path=*\\cmd.exe parent_path=*\\svchost.exe  (ipconfig OR "net view" OR "net config" OR nltest OR whoami OR hostname OR tasklist ) | stats values(command_line) count by computer_name process_path Using stats to group the command lines for visibility Previously I had done something more complex based on the JPCERT analysis to detect reconn more generally. https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html @Cyb3rops did this in a very similar manner way before I did. https://github.com/Neo23x0/sigma/blob/master/rules/windo...

Previously I wrote about calculating duration but I stumbled across a better method. There are two key factors, time stamps in Splunk are numbers and Carbon Black has a process_guid that links the life of the process. We'll use these two things to make a much shorter search. Previous search index=edr event_type=proc process_path=*\\userinit.exe | stats values(type) as types values(_time) as timestamps values(process_path) as proc_path by process_guid | where mvcount(types)>1 | eval end_time=mvindex(timestamp,1) | eval start_time=mvindex(timestamp,0) | eval duration=end_time-start_time | table process_guid types duration timestamps proc_path New search index=edr event_type=proc process_path=*\\userinit.exe | stats range(_time) as duration values(command_line) count by computer_name process_guid As you can see it is much more compact and readable. References: https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/CommonStatsFunctions

Watching for suspicious scheduled tasks is always a good thing but there are a lot of them so some creative categorization will be needed. This method is just to view tasks as they execute, not as they are being created. Scheduled tasks should be the child process of svchost.exe so I started by breaking it into several different searches based on our normal suspicious scripting processes. Powershell.exe Cscript.exe Wscript.exe Mshta.exe Cmd.exe I'll use stats and pc counts again to self tune out those that are common to a given number of pcs. I run this back a couple of days so that the auto tuning kicks in. Wscript Tasks index=edr process_path=*\\wscript.exe parent_path=*\\svchost.exe | stats dc(computer_name) as pc_count values(computer_name) count by command_line | Where pc_count Add tuning as necessary to get rid of normal tasks and you "should" be able to get it down to a short list. Repeat with the other target children and add any others that yo...

BLUF: As Countercept noted, Look for children of:     Eventvwr.exe CompMgmtLauncher.exe Fodhelper.exe A quicky on some old UAC bypasses since it just came up again ITW. SBousseaden shared an Anyrun and some notes on two UAC bypasses: mscfile\shell\open\command ms-settings\shell\open\command mscfile activates from eventvwr.exe or CompMgmtLauncher.exe ms-settings activates using Fodhelper.exe They are well documented. Eventvwr has been patched but CompMgmtLauncher still works, fodhelper, I couldn't test but I assume it works the same way. Testing for the regmods are fine using an EDR but a quick and dirty method is to look for children of the three processes and filter the normal ones. References: https://twitter.com/SBousseaden/status/1143848669407588352 https://twitter.com/countercept/status/842023313467707393 https://github.com/ChaitanyaHaritash/My-Exploits/tree/master/COMPMGMTLAUNCHER_UAC_BYPASS https://enigma0x3.net/2016/08/15/fileless-...

By now most shops have a good selection of powershell rules, long command lines, netconn, keywords, obfuscation and so on so I am on the lookout for those that might not trigger anything. A recent tweet from Clearsky included an Anyrun trace (always a good source for techniques) that showed cmd echoing commands to powershell without powershell showing the command line so I dug into it a bit. From the references you can see that it isn't new. GBHackers had a good explanation - "Powershell command that ends with Dash “-“ ,that will Execute the command by using standard input (Stdin) and only the dash will appear in powershell.exe’s command line arguments." Cmd using echo  "Powershell -" Also note that while powershell is a child of cmd, it is not the one with the command arguments. Testing showed that the "| powershell -" was not in the command lines from my EDR. Detection There are a couple of ways to go about detecting this....

I get something out of twitter almost every day and it is not uncommon to see examples a few times before the realization sinks in that you are looking at a technique that needs a rule. These should fall under the ATT&CK framework as masquerading. I saw a tweet the other day that reminded me of a couple of signatures worth talking about. These misleading double extensions are not new but they never seem to go out of style. With modern EDRs it is an easy win. The malware filename ended in .xls.exe but lets expand that to include other office file types. index=edr ( doc OR docx OR xls OR xlsx OR pdf ) exe ( process_path=*.doc.exe OR process_path=*.docx.exe OR process_path=*.xls.exe OR process_path=*.xlsx.exe OR process_path=*.pdf.exe ) The sig is largely self explanatory, the tokenization allows for keyword search by breaking up the extension, and the process path stuff just anchors it all to the process name since these are pretty generic terms. Another tweet by blackor...

Update: See "An easier method of finding duration of processes" to simplify this. I came across this interesting tweet from @subTee that got me interested in not just this TTP but looking at process durations in general. That could be a good method to have in the toolbox. It makes sense that userinit.exe should not run for long so I looked to see how I could calculate the duration using Carbon Black process logs. One method of calculating values where you need timestamps from two different events is to use the Splunk streamstats command but I try to avoid it because it can be slow. Luckily Carbon Black shows an event for both process start and process stop which has the timestamps so I just needed to get them together. field name "type" contains process start or process stop field name process_guid contains the unique id for the process Calculate the duration of the process index=edr event_type=proc process_path=*\\userinit.exe | stats values(type) ...

Having signatures for common techniques is great but let's take it to the next level. Imagine if a script executable is simply copied with a new name, will your dectection still trigger? This is a good technique to keep in mind while creating searches. Take a look at the following Splunk search to detect mshta.exe with suspicious strings. index=edr mshta.exe getobject script (vbscript OR javascript) command_line!="" | table command_line process_path computer Works great, lasts a long time right, but a central match is the mshta.exe string. Here is another version which negates the mshta.exe to catch just those where the file has been renamed, which in my view would be a higher severity and I want to see those separately. index=edr mshta.exe getobject script (vbscript OR javascript) NOT mshta command_line!="" | table command_line process_path computer Here is another example to find the -accepteula string from sysinternals psexec. index=edr -acce...

Sometimes it is helpful, especially in a large organization, to break up a search like C2 or processes with netconn into categories based on the directory. The directory may even provide some help with triage as we can make some basic assumptions. download: user initiated temp: generally not user initiated appdata: the installer wants to look legitimate All of these are fuzzy but I generally find potentially unwanted programs(PUPs) starting from download and the initial callback can help to identify it. Temp can be anything but those are sometimes the most interesting. For appdata installs I generally look at the directory name first, legitimate installs mimic the installer name while PUPs try to be clever and use a nonsense name. Finding generic malware isn't sexy but if you hope to find the tricky stuff then you'll need a good base detection for everything else. As usual, any filtering has been left out of these examples. Executions from Appdata\roaming -not netconn...