Matt Swann
@McswannDenver, COCompletionist
0 followers4 downloads285 copies7 likes473 views
16 detections
Filters
Last updated
All Time
Detection languages
16
Categories
2
1
1
MITRE Techniques
2
2
2
1
1
ChocoShell attempts UAC bypass for privilege escalation leveraging SilentCleanup and creates a blank .tmp file in the process via the command line: cmd /c echo.>"C:\Users\<u>\AppData\Local\Temp\.<hexTickCount>.tmp", with the file being up to 8 chars long. One should expect to see svchost as the parent process to cmd.exe given that SilentCleanup runs as a service that resolves %windir% from a hijacked HKCU:\Environment\windir variable.
Threat actors, particularly ransomware operators, are known to attept to disable EDR tooling prior to completing their actions on objectives in order to better carry our their actions uninhibited. Ransomware groups such as The Gentlemen have been observed using PowerShell to disable Microsoft Defender real time protection.
* Note if you are standardized on MITRE ATT&CK v19, this is now tracked as T1685.001
* Note if you are standardized on MITRE ATT&CK v19, this is now tracked as T1685.001
These are extracted IoCs from a QuimaRAT sample I tore apart on my personal blog, found in the resources linked below. This is just one of many samples, so while it is certainly not all encompassing pertaining to all QuimaRAT activity, it does a great job serving as a starting point. As you will read in my analysis, QuimaRAT relies on a config file created that allows for many parameters to be changed. I did my best to focus on high-fidelity IoCs and not rely on any easily modified values in the configuration file.
PySoxy is a SOCKS proxy follow-on observed in recent ClickFix campaigns, serving to establish additional C2 and persistence on a victim. In the reference article attached, the command line for this Python-based SOCKS proxy leveraged a compiled Python (.pyc) file, and required specifying both a remote IP and remote port for the outbound connection.
Identifies an unknown binary being access in some way (see AccessMask below) on the NETLOGON or SYSVOL share of a DC. Ransomware operators often stage ransomware executables here before deploying ransomware to an organization. While this query currently hits on ALL AccessMask values, you may want to tune out the less critical ones near the bottom of the list. Of course, Read & Execute is the most concerning, though you may want visibility into others depending on your environment. As always, test in your environment for known behavior and tune accordingly before operationalizing.
Identifies an unknown binary being access in some way (see AccessMask below) on the NETLOGON or SYSVOL share of a DC. Ransomware operators often stage ransomware executables here before deploying ransomware to an organization. While this query currently hits on ALL AccessMask values, you may want to tune out the less critical ones near the bottom of the list. Of course, Read & Execute is the most concerning, though you may want visibility into others depending on your environment. As always, test in your environment for known behavior and tune accordingly before operationalizing.
Page 2 of 2