Blu3_Team

This was a great share by @subtee about misleading directory names and worthy of a quick sig. I needed a few more tunes than shown but this is the general idea. Evasive program files directory name   index=edr program process_path=c:\\program* process_path!="c:\\program files\\*" process_path!="c:\\program files (x86)\\*" process_path!=c:\\programdata\\* | table process_path md5 command_line parent_path I add the md5 to the table for quick review if I get any hits. References: https://twitter.com/subTee/status/1187037543260274688

Screen saver files have a small filterable list of normal parents that can expose malicious scr files during execution. https://twitter.com/Timele9527/status/1186816375857139712 https://app.any.run/tasks/e076b4a8-abfb-41a1-b7b5-3eadced93192/ #APT #TransparentTribe SCR from unusual parent index=edr scr process=*.scr process_path!=*\\windows\\syswow64\\* process_path!=*\\windows\\system32\\* parent_process!=*\\winlogon.exe | table process_path md5 parent_path command_line References: https://twitter.com/Timele9527/status/1186816375857139712 https://app.any.run/tasks/e076b4a8-abfb-41a1-b7b5-3eadced93192/

Sample: https://app.any.run/tasks/455f13a6-c615-4969-bbfb-50967760b158/ Here is a nice sample of #adwind using a few child processes (cmd, xcopy, reg, attrib, and javaw) that we can use as a cluster TTP.  In addition, the malware is impatient so it does all this in a few seconds as well, which will help isolate the behavior when searching over long time frames. Here is the search minus a couple of tunes I needed: index=edr java.exe parent_path=*\\java.exe ((cmd.exe cscript.exe) OR (reg.exe add) OR taskkill.exe OR attrib.exe OR xcopy.exe )    | bucket _time span=1m    | stats values(command_line) dc(command_line) as command_count values(process) dc(process) as proc_count count by computer_name _time    | where command_count>2 AND proc_count>2 Breakdown: The parent must be java.exe The bucket sets the one minute time frame for the events Command_count gives us the unique event count for command lines Proc_count gives us the distinct count of the process names since w...

One of the TTPs for #Ursnif samples has been to use WMI classes to launch powershell.  This shows in the EDR as wmiprvse.exe as the parent of the malicious powershell process but it is not evident what initiated the process since the parent child relationship has been broken.  You probably already have a signature for the wmiprvse.exe as parent to powershell and the Word file containing the macro uses a detectable name format "info_10_1.doc".  It would be nice to fill in the attack chain a bit to speed up the analysis process. One interesting method is to use the proximity of the winword.exe startup event to the wmiprvse.exe parent event.  This might seem like a good place for a Splunk transaction but I find them slow at times so I tend to use the Stats command where possible. Detect Wmiprvse.exe as parent in close proximity to Winword.exe starting index=edr procstart ( winword.exe OR wmiprvse.exe ) (process=winword.exe OR parent_path=*\\wmiprvse.exe) | ...

Right now your enterprise network with all its users and systems is a live production lab for any malware or attacker that comes along. If you have an EDR you have an advantageous view of the the endpoints. How about installing that same EDR on your malware analysis system so you can review signatures and TTPs from malware in a controlled environment? You'll be surprised the difference it makes in finding new TTPs. I have always felt it would be nice to be able to allow some traffic out of a dynamic malware analysis lab without letting it all out. As a rule I don't allow malware to talk directly to the Internet without a very good reason to do so. Now with EDR technology available it became crucial to allow the EDR to be able to connect to the mothership while restricting all other traffic to the host only malware network. But once this is setup we can expand things a bit and allow api.ipify.org and other benign traffic. Here is how I did it. If you have a different way I ...

I recently took a look at Powershell DNS C2 and found a couple of interesting things. The special case of DNS requests from powershell should be easy enough to identify using an EDR. Using splunk and stats just look for multiple remote port 53 occurrances from powershell. There will be a few but DNS c2 is noisy so a large limit can be used for filtering. Next I took a look at DNSCat https://github.com/lukebaggett/dnscat2-powershell Interestingly powershell does not make the dns request directly but spawns nslookup to do it. Easy enough to make a signature for that. Again, powershell calling nslookup will occur legitimately, but a large filter for occurrences will filter those out. index=edr powershell.exe nslookup.exe parent_path=*\\powershell.exe | stats values(command_line) count by computer_name parent_process_guid | where count>10 Next I went back to some old Oilrig samples which used DNS C2. Nothing new here, just multiple DNS requests directly from powershell. B...

https://www.vkremez.com/2018/04/lets-learn-trickbot-implements-network.html Vitali and others have noted that trickbot is running reconn commands. I finally saw them in action and these happen to be children of svchost so I did a quick sig and it looks pretty reliable and quiet. Nothing fancy, just looking for cmd.exe as a child of svchost.exe with common reconn command lines. index=edr svchost.exe process_path=*\\cmd.exe parent_path=*\\svchost.exe  (ipconfig OR "net view" OR "net config" OR nltest OR whoami OR hostname OR tasklist ) | stats values(command_line) count by computer_name process_path Using stats to group the command lines for visibility Previously I had done something more complex based on the JPCERT analysis to detect reconn more generally. https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html @Cyb3rops did this in a very similar manner way before I did. https://github.com/Neo23x0/sigma/blob/master/rules/windo...