8.B) Software Packing

[Cyb3rWard0g]

Description

Next, the attacker uploads a new UPX-packed payload (T1045) to the secondary victim.

[meterpreter (PowerShell)\*] > Invoke-SeaDukeStage -ComputerName NASHUA

[patrickstjohn]

49 Not sure how you want to accept Sigma rules. Feel free to toss it out if you have something else planned.

[Cyb3rWard0g]

Thank you for sharing @patrickstjohn ! That works. Thank you for creating the folder and starting the contributions :) I appreciate it!

[Cyb3rWard0g]

8.B.1 Remote File Copy

Procedure: Copied python.exe payload from a WebDAV share (192.168.0.4) to remote host Scranton (10.0.1.4) Criteria: The file python.exe created on Scranton (10.0.1.4)

[Cyb3rWard0g]

Security Events

SELECT Message
FROM apt29Host
WHERE LOWER(Channel) = "security"
  AND EventID = 5145
  AND RelativeTargetName LIKE '%python.exe'

Results

 Message | A network share object was checked to see whether client can be granted desired access.

Subject:
    Security ID:        S-1-5-21-1830255721-3727074217-2423397540-1107
    Account Name:       pbeesly
    Account Domain:     DMEVALS
    Logon ID:       0x861A79

Network Information:    
    Object Type:        File
    Source Address:     10.0.1.4
    Source Port:        59967

Share Information:
    Share Name:     \\*\ADMIN$
    Share Path:     \??\C:\windows
    Relative Target Name:   Temp\python.exe

Access Request Information:
    Access Mask:        0x80
    Accesses:       ReadAttributes

Access Check Results:
    -

 Message | A network share object was checked to see whether client can be granted desired access.

Subject:
    Security ID:        S-1-5-21-1830255721-3727074217-2423397540-1107
    Account Name:       pbeesly
    Account Domain:     DMEVALS
    Logon ID:       0x861A79

Network Information:    
    Object Type:        File
    Source Address:     10.0.1.4
    Source Port:        59967

Share Information:
    Share Name:     \\*\ADMIN$
    Share Path:     \??\C:\windows
    Relative Target Name:   Temp\python.exe

Access Request Information:
    Access Mask:        0x17019F
    Accesses:       DELETE
                READ_CONTROL
                WRITE_DAC
                SYNCHRONIZE
                ReadData (or ListDirectory)
                WriteData (or AddFile)
                AppendData (or AddSubdirectory or CreatePipeInstance)
                ReadEA
                WriteEA
                ReadAttributes
                WriteAttributes

Access Check Results:
    -

 Message | A network share object was checked to see whether client can be granted desired access.

Subject:
    Security ID:        S-1-5-21-1830255721-3727074217-2423397540-1107
    Account Name:       pbeesly
    Account Domain:     DMEVALS
    Logon ID:       0x861A79

Network Information:    
    Object Type:        File
    Source Address:     10.0.1.4
    Source Port:        59967

Share Information:
    Share Name:     \\*\ADMIN$
    Share Path:     \??\C:\windows
    Relative Target Name:   Temp\python.exe

Access Request Information:
    Access Mask:        0x2
    Accesses:       WriteData (or AddFile)

Access Check Results:
    -

[Cyb3rWard0g]

Sysmon Logs

SELECT Message
FROM apt29Host
WHERE Channel = 'Microsoft-Windows-Sysmon/Operational'
    AND EventID = 11
    AND TargetFilename LIKE '%python.exe'

Results

File created:
RuleName: -
UtcTime: 2020-05-02 03:10:23.626
ProcessGuid: {5aa8ec29-cad1-5eac-0100-000000000400}
ProcessId: 4
Image: System
TargetFilename: C:\Windows\Temp\python.exe
CreationUtcTime: 2020-05-02 03:10:23.626

[Cyb3rWard0g]

8.B.2 Software Packing

Procedure: python.exe payload was packed with UPX Criteria: Evidence that the file python.exe is packed