This blog post from CrowdStrike provides some good information related to the persistence mechanisms used by WannaMine cryptomining worm. According to the post, WannaMine employs “living off the land” techniques such as Windows Management Instrumentation (WMI) permanent event subscriptions as a persistence mechanism. It is really interesting that crypto mining malware adapt so quickly their TTPs and use techniques that are mostly used by APT groups.
European Union Agency for Network and Information Security (ENISA) has recently released the report on Tools and Methodologies to Support Cooperation between CSIRTs and Law Enforcement.
The report aims to support the cooperation between CSIRTs – in particular national/governmental CSIRTs – and LEAs in their fight against cybercrime, by providing information on the framework and on the technical aspects of the cooperation, identifying current shortcomings, and formulating and proposing recommendations on technical aspects to enhance the cooperation.
I read the following tweet by Florian Roth a couple of days ago:
People frequently ask me about process hollowing/doppelgänging, spectre/meltdown, skeleton keys & attack vectors involving liquid nitrogen.
Recently I replied:
Would you notice someone running “whoami” on one of your servers? https://t.co/Y4e8YaFdtt
— Florian Roth (@cyb3rops) January 27, 2018
I could not agree more with the reply from Florian. See below a list of resources that help tuning detection mechanisms for post exploitation activities.
- Windows enumeration commands
- Windows post exploitation resources
- Living off the land
- Windows commands abused by the attackers
- Post Exploitation using WMIC
- Post Exploitation in Windows using dir Command
- Post Exploitation on Windows PC
- Linux post exploitation
- Patterns of behaviour
Enjoy and happy hunting ;)
- Red Tip #1: Profile your victim and use their user agent to mask your traffic. Alternatively use UA from software such as Outlook.
- Red tip #2: If the enemy SOC is using proxy logs for analysis. Guess what? It won’t log cookies or POST body content as can be sensitive.
- Red tip #3: Taking a snapshot of AD can let you browse, explore and formulate future attacks if access is lost momentarily.
- Red tip #4: consider using Office Template macros and replacing normal.dot for persistence in VDI environments.
- Red tip #5: Do a DNS lookup for terms such as intranet, sharepoint, wiki, nessus, cyberark and many others to start intel on your target.
I recently came across an interesting research paper from University of Innsbruck. The title of the parer is “Threat Intelligence Sharing Platforms: An Exploratory Study of Software Vendors and Research Perspectives“.
According to the abstract of the paper: “In the last couple of years, organizations have demonstrated an increased willingness to exchange information and knowledge regarding vulnerabilities, threats, incidents and mitigation strategies in order to collectively protect against today’s sophisticated cyber attacks. As a reaction to this trend, software vendors started to create offerings that facilitate this exchange and appear under the umbrella term “Threat Intelligence Sharing Platforms”. To which extent these platforms provide the needed means for exchange and information sharing remains unclear as they lack a common definition, innovation in this area is mostly driven by vendors and empirical research is rare. To close this gap, we examine the state-of-the-art software vendor landscape of these platforms, identify gaps and present arising research perspectives. Therefore, we conducted a systematic study of 22 threat intelligence sharing platforms and compared them. We derived 8 key findings and discuss how existing gaps should be addressed by future research.”
The authors conduct their research by exploring the capabilities of the following 22 Threat Intelligence Platforms:
The ENISA Threat Landscape 2016 is out! This is the annual report published by ENISA that provides useful insights on the cyber threats observed during the past year. Apart from the top cyber threats, the report provides information on threat actors and major attack vectors observed. Finally, the conclusion section provides a collection of issues that will challenge the cyber-security community in the coming months/year in various degrees of intensity.
Some highlights of the report are the following ones:
- Cyber Threat Intelligence and ETL – “Cyber Threat Intelligence: State-of-play” and the “CTI Big Picture“
- Threat Agents – “Trends” and “Top threat agents and motives“
- Conclusions – “Main cyber-issues ahead” and “Conclusions“
Read below the executive summary of the report:
2016 was a year full of interesting presentations and conferences! I took a moment to think about the presentations that helped me better understand the threat landscape, introduced me to new tools and processes, provided inspiration for my team and help me with my daily operations.
The selection of the presentations below is subjective but indicative of the trends regarding the DFIR community during 2016. Moreover, the below sequence is completely random.
I would appreciate any feedback and I would be more than happy to be sent your ones! Enjoy!