1
00:00:16,030 --> 00:00:20,270
This is Cheerio presenting indicators of immunization.

2
00:00:20,270 --> 00:00:22,750
And with that, I will let Cheerio take it away.

3
00:00:22,750 --> 00:00:23,950
Thank you.

4
00:00:24,750 --> 00:00:26,230
Hi, everyone.

5
00:00:26,230 --> 00:00:28,130
Thanks so much for coming here.

6
00:00:28,130 --> 00:00:31,530
So let's jump right in.

7
00:00:32,570 --> 00:00:38,330
So really quick, I am not speaking on behalf of any of my employers.

8
00:00:38,570 --> 00:00:45,210
Everything I say is basically my opinion and not necessarily that of my employer.

9
00:00:45,210 --> 00:01:07,870
So now that we have that out of the way, I'm going to do a TLDR on this and basically tell you that this talk is about taking the Windows command line arguments and PowerShell and seeing what the heck we can do with it as a cyber threat intelligence professional to provide to other teams in the organization.

10
00:01:07,870 --> 00:01:12,330
So that basically sums up my talk in about a sentence.

11
00:01:12,570 --> 00:01:18,930
So if you're interested in playing along, stick with me.

12
00:01:20,510 --> 00:01:26,050
So Katie Kuzianovic, and I apologize, I probably didn't pronounce that right.

13
00:01:26,050 --> 00:01:27,190
I'm sorry.

14
00:01:27,430 --> 00:01:30,170
Her DerbyCon 8 presentation.

15
00:01:30,170 --> 00:01:35,570
And she said that blocked data is the glitter of the TI data world.

16
00:01:35,570 --> 00:01:40,690
And so ever since DerbyCon 8, that's kind of really stuck with me.

17
00:01:40,730 --> 00:02:02,490
And in the spirit of the discovery theme this year for DEF CON, I decided, hey, why not explore this a little bit further and see what I can do with actual blocked data and see how I can extract intelligence and information to be able to feed to different teams.

18
00:02:02,490 --> 00:02:12,670
So fast forward about 13 months, and I go to Matt Kelly's B-Side Chicago talk in 2019.

19
00:02:12,670 --> 00:02:18,730
And it was a great presentation on threat emulation, adversary-focused red teams.

20
00:02:18,730 --> 00:02:31,870
And in it, he gave a really interesting graph and information about some ideas as far as how threat intelligence can help feed red teams and adversary emulation.

21
00:02:31,870 --> 00:02:33,870
So that kind of stuck with me.

22
00:02:34,070 --> 00:02:43,170
Then fast forward another five months, and I reached out to Bryce and Bort because over at Psy, they have something called a marketplace.

23
00:02:43,230 --> 00:02:50,610
And basically, it's, you know, I'm going to paraphrase horribly, so please forgive me.

24
00:02:50,890 --> 00:03:05,130
It's like a thing for researchers to research threat actors out there and then help build out some of the adversary emulation that they have, right?

25
00:03:05,130 --> 00:03:07,230
So I'm like, oh, that sounds so fascinating.

26
00:03:07,230 --> 00:03:08,890
I want to get involved.

27
00:03:09,070 --> 00:03:13,070
And so Bryce got me in touch with Adam Maschini, and I apologize.

28
00:03:13,070 --> 00:03:14,430
I may have pronounced that wrong.

29
00:03:14,430 --> 00:03:15,690
Please forgive me.

30
00:03:16,470 --> 00:03:25,750
And he pointed out that there were a lot of threat intel reports with Linux commands, Linux-related commands, but there wasn't too much with Windows.

31
00:03:25,750 --> 00:03:40,750
So I decided that semester I was doing a malware analysis course, and I'm like, huh, this would be a really interesting project to take on and see just what it's about and where it will lead me, right?

32
00:03:40,750 --> 00:03:49,310
So I'm like, okay, so I will just enable Windows command line logging, and it's just easy.

33
00:03:49,310 --> 00:03:58,430
So what I did is I got a VM, and then I figured out how to turn on the logs and all of that, right?

34
00:03:59,970 --> 00:04:03,870
Disable all the security stuff, especially the smart screen.

35
00:04:03,870 --> 00:04:08,050
And God, it was so much disabling of so much security, it was crazy.

36
00:04:08,090 --> 00:04:11,690
And I just want to do a shout out to Microsoft Windows.

37
00:04:11,790 --> 00:04:22,750
Like, I cannot tell you how hard it was for me, like how many things I had to disable and go through in order to execute malware on the VM.

38
00:04:22,750 --> 00:04:23,510
It was crazy.

39
00:04:23,510 --> 00:04:27,030
I'm like, holy crap, they do a really good job.

40
00:04:28,170 --> 00:04:31,630
Like, yeah, I mean, just try.

41
00:04:31,790 --> 00:04:33,350
It's involved.

42
00:04:34,590 --> 00:04:37,770
So what I did, too, is I created a baseline.

43
00:04:38,150 --> 00:04:45,790
So Windows command line logging, if you look over it, you're like, what the H is that, right?

44
00:04:45,830 --> 00:04:58,570
So before introducing malware into the environment, I decided to just watch the command line a little bit and get a better understanding, because Defer isn't my 24-7 life, right?

45
00:05:00,530 --> 00:05:07,870
And also, too, since I did it for a doctoral class, I decided, well, let's get a control, too.

46
00:05:07,870 --> 00:05:17,790
You know, kind of make it an experiment so that I can have the control, and I can have malware samples in the wild and kind of see what it is that's going on.

47
00:05:17,790 --> 00:05:20,550
So I was like, how do I create a control?

48
00:05:20,550 --> 00:05:21,970
I don't know how to make malware.

49
00:05:22,190 --> 00:05:24,890
So I don't know how to do all that stuff.

50
00:05:24,890 --> 00:05:27,170
So there were three options that I found.

51
00:05:27,650 --> 00:05:32,710
One was making a quote-unquote test malware, which I'll share with you on the screen there.

52
00:05:32,710 --> 00:05:35,610
You can see it on the left.

53
00:05:35,610 --> 00:05:41,830
Basically, I took Sector 7's Red Team Operator Malware Dev course.

54
00:05:42,130 --> 00:05:56,610
And, of course, he doesn't just have StartCalc in his class, but that gave me the idea to just compile a C++ program and have it StartCalc.

55
00:05:56,610 --> 00:05:58,030
Really benign.

56
00:05:58,030 --> 00:05:59,830
The code's right up there.

57
00:05:59,870 --> 00:06:02,270
And see if it actually works, right?

58
00:06:02,270 --> 00:06:03,010
And it did.

59
00:06:03,010 --> 00:06:05,530
Another option was Atomic Red Team.

60
00:06:05,970 --> 00:06:11,510
So they did such a fabulous job at spelling out how to install it, how to get it done.

61
00:06:11,510 --> 00:06:12,510
It was so quick.

62
00:06:12,710 --> 00:06:22,410
I just put in a couple commands, and it was done, and I could run the different PowerShell things to ensure the PowerShell logging and all that stuff was set up correctly.

63
00:06:22,590 --> 00:06:26,430
And then the final option is just to manually enter the commands myself.

64
00:06:26,830 --> 00:06:32,790
So I did all of that, and then I'm like, where am I going to get all this malware from?

65
00:06:33,470 --> 00:06:45,770
So I tried any run, you know, you change the extension from bin.bin to .exe, and didn't really get anything.

66
00:06:45,770 --> 00:06:50,270
And I'm like, well, is the malware dysfunctional?

67
00:06:50,270 --> 00:06:51,910
Like, is it not working?

68
00:06:51,910 --> 00:06:56,110
Or is it, you know, anti-VM stuff?

69
00:06:56,110 --> 00:06:57,550
Like, defense evasion?

70
00:06:57,550 --> 00:06:58,470
What's going on?

71
00:06:58,470 --> 00:06:59,170
Or is it me?

72
00:06:59,170 --> 00:07:00,630
Am I just not clicking enough?

73
00:07:00,630 --> 00:07:02,830
Or who knows what, right?

74
00:07:02,830 --> 00:07:05,770
The security person in me is like, don't click!

75
00:07:05,950 --> 00:07:09,530
So I was like, okay, I don't know what's going on with that.

76
00:07:09,530 --> 00:07:16,370
And then I tried a malware hybrid analysis, and then malware bizarre as well, and I didn't have any luck.

77
00:07:16,370 --> 00:07:18,090
So I'm like, what is going on?

78
00:07:18,090 --> 00:07:20,570
So finally, I was just like, screw it.

79
00:07:20,570 --> 00:07:39,630
I am just going to URL house, taking the most recent, like, posting that people submitted, and going to the actual attacker's domain and pulling down the malware myself, so that it's fresh, and so that I know that it's not user error, or who knows what else,

80
00:07:39,630 --> 00:07:40,450
right?

81
00:07:40,850 --> 00:07:43,930
And I tried multiple other malware repositories.

82
00:07:43,930 --> 00:07:46,270
I was like, why is this not executing?

83
00:07:46,270 --> 00:07:48,250
Or what's going on, right?

84
00:07:48,250 --> 00:07:50,610
And here's a funny story.

85
00:07:50,610 --> 00:07:55,130
Someone told me to go talk to Bleeping Computer and ask them.

86
00:07:55,130 --> 00:07:58,390
I'm like, yeah, that's probably a bad idea.

87
00:07:58,650 --> 00:08:02,910
Anyways, so that was a really fun story.

88
00:08:03,490 --> 00:08:12,830
So I put up here some of the results of the tests when I pulled the malware myself, from the actual source.

89
00:08:13,190 --> 00:08:23,850
And as you can see, like, you know, some of them gave me command line arguments beyond the initial execution of the binary.

90
00:08:23,850 --> 00:08:26,390
Some of them didn't, most of them didn't.

91
00:08:26,390 --> 00:08:29,470
So I'm like, huh, why?

92
00:08:29,750 --> 00:08:31,370
What is it doing?

93
00:08:31,450 --> 00:08:34,210
So then I'm like, oh, there's static analysis.

94
00:08:34,510 --> 00:08:39,090
So then I download Ghidra, and of course, IDA and all of that.

95
00:08:39,090 --> 00:08:42,650
And I'm like, wait, I don't really know how to use this very well.

96
00:08:42,650 --> 00:08:47,350
So Joe Slowik, he's like the meme master.

97
00:08:47,350 --> 00:08:49,050
He's awesome.

98
00:08:49,050 --> 00:08:55,710
He recently posted something with a guy trying to drink water, and he's like, drink water like this?

99
00:08:55,710 --> 00:08:58,390
You know, like, that's how I felt.

100
00:08:58,390 --> 00:08:59,630
It was so bad.

101
00:08:59,630 --> 00:09:07,150
I'm like, oh, my God, like, the learning curve on that is just a little bit more than I'm willing to invest right now.

102
00:09:07,150 --> 00:09:07,870
I will.

103
00:09:07,870 --> 00:09:14,130
It's just I wanted to get through this and make it accessible to as many people as possible.

104
00:09:14,130 --> 00:09:19,430
So I decided to move on with my life and try something else.

105
00:09:19,430 --> 00:09:34,110
So SANS Defer Summit 2020, actually July, not too long ago, you know, about five months after the Brace and Bort meeting, I spoke with Michael Gao, Mr.

106
00:09:34,110 --> 00:09:35,930
Malware Archaeology.

107
00:09:35,930 --> 00:09:37,410
He is super awesome.

108
00:09:37,410 --> 00:09:41,630
He did the command line logging cheat sheets.

109
00:09:41,630 --> 00:09:43,810
I don't know if you're familiar with those.

110
00:09:43,810 --> 00:09:45,850
They have just a wealth of information.

111
00:09:45,850 --> 00:09:47,910
And I told him some of the problems I was having.

112
00:09:47,910 --> 00:09:50,470
And I'm like, what's wrong with me?

113
00:09:50,770 --> 00:09:58,150
And he suggested to just buy a computer and, like, bypass all of the anti-analysis stuff.

114
00:09:58,150 --> 00:10:02,930
And I was like, oh, my gosh, I, like, never would have thought of that.

115
00:10:02,930 --> 00:10:05,510
Never, like, in a gazillion years.

116
00:10:05,510 --> 00:10:13,870
So I bought two computers, but not willingly.

117
00:10:14,150 --> 00:10:16,510
So the first one I bought was dead on arrival.

118
00:10:16,510 --> 00:10:21,790
And I'm like, I'm like, I don't have time to try to troubleshoot this.

119
00:10:21,790 --> 00:10:24,150
It's actually still sitting right next to me.

120
00:10:24,150 --> 00:10:27,210
So then I bought another one that was delivered the next day.

121
00:10:27,210 --> 00:10:29,450
And that one actually worked.

122
00:10:29,450 --> 00:10:30,570
Thank God.

123
00:10:31,930 --> 00:10:41,130
So some of the results of that, as you can see, I had, I picked one random sample.

124
00:10:42,130 --> 00:10:52,450
And threw it into a couple of different sandbox solutions to see the difference between the command line arguments that I would get from all these different solutions, right?

125
00:10:52,450 --> 00:10:56,550
The one in the upper left-hand corner, virus total, as you can see.

126
00:10:56,550 --> 00:11:01,210
Oh, okay, so we got the initial binary executing.

127
00:11:01,210 --> 00:11:02,190
Cool.

128
00:11:02,190 --> 00:11:02,990
Okay.

129
00:11:02,990 --> 00:11:06,490
So cape up in the right-hand corner.

130
00:11:06,490 --> 00:11:07,590
Okay.

131
00:11:07,590 --> 00:11:11,510
And then Joe sandbox, holy crap, that's a lot of stuff.

132
00:11:11,730 --> 00:11:25,490
But then what I got, I got 70-something pages of command line arguments and PowerShell commands and all of that from this one particular sample.

133
00:11:26,470 --> 00:11:28,030
Here's just some of it.

134
00:11:28,030 --> 00:11:35,950
Some of it looks like it could be useful for potential adversary emulation exercises, potentially.

135
00:11:37,190 --> 00:11:45,210
So the funny thing about this, so I decided to do a little bit of research on the Raccoon Stealer.

136
00:11:45,210 --> 00:11:49,210
And I came across a Cyber Reason blog on this.

137
00:11:49,210 --> 00:11:58,670
And they said, oh, yeah, one of the main complaints about it by criminals is that it has a very low success rate of 45%.

138
00:11:58,670 --> 00:12:07,130
So as I was going through on my actual real computer, not a VM, it asked me to install the .NET framework.

139
00:12:07,130 --> 00:12:18,230
And I'm like, you know, that's a lot of work for the average user to install this so that you can read an invoice or whatever.

140
00:12:19,870 --> 00:12:22,790
I'm like, no wonder why it has a low success rate.

141
00:12:22,790 --> 00:12:24,610
At least that's my understanding of it.

142
00:12:24,610 --> 00:12:29,710
And I didn't really find that anywhere in a lot of the blogs that I read.

143
00:12:29,710 --> 00:12:34,150
So definitely it's a huge advantage that now I know this.

144
00:12:34,150 --> 00:12:44,970
Now it requires me, in order for this particular variant of Raccoon Stealer to work, I have to install the .NET framework of that version.

145
00:12:44,970 --> 00:13:02,690
So if your enterprise computers, whatever, aren't using that and would require the installation of that particular .NET framework, then this particular variant would be a really low threat to you.

146
00:13:02,690 --> 00:13:06,170
So you wouldn't necessarily need to proceed with analysis.

147
00:13:06,290 --> 00:13:09,570
But here's a little fun tidbit.

148
00:13:09,570 --> 00:13:14,830
So as I was going along, I got a little pop-up video and it said, Nyan Cat.

149
00:13:14,830 --> 00:13:16,410
Like, who doesn't love Nyan?

150
00:13:16,570 --> 00:13:17,970
Nyan Cat, right?

151
00:13:17,970 --> 00:13:19,450
I'm like, Pop Tarts?

152
00:13:19,490 --> 00:13:20,190
Cats?

153
00:13:20,250 --> 00:13:20,890
Rainbows?

154
00:13:20,890 --> 00:13:21,530
Sure.

155
00:13:21,890 --> 00:13:27,730
So it said, make this connection available for all users or my use only.

156
00:13:27,830 --> 00:13:30,590
And I was like, oh, I don't know what to do.

157
00:13:31,330 --> 00:13:34,530
You know, of course, I did this safely, on and on and on.

158
00:13:34,530 --> 00:13:36,650
So I was like, you know what?

159
00:13:37,070 --> 00:13:42,170
I'm just going to roll with it and click OK and see what happens.

160
00:13:42,170 --> 00:13:43,590
And so I was really excited.

161
00:13:43,590 --> 00:13:48,250
I was hoping like, you know, CrowdStrike came to mind.

162
00:13:48,250 --> 00:13:58,450
I'm actually wearing one of their shirts where the activity of actors, how quick they are to jump on connections and stuff like that.

163
00:13:58,450 --> 00:14:09,310
So I was waiting and waiting and I'm like, you know, excited because I'm expecting like, you know, something, something to happen, anything to happen.

164
00:14:09,310 --> 00:14:11,610
And hours later, still nothing.

165
00:14:11,610 --> 00:14:15,990
And I'm like, all right, like, I have to move on with this.

166
00:14:15,990 --> 00:14:19,510
But it was fun and exciting for a little bit, like waiting.

167
00:14:20,490 --> 00:14:22,170
It was good.

168
00:14:22,170 --> 00:14:31,930
And another thing, because it dropped files in the temp directory, I was like, oh, well, let's just go look there for fun and see what happens.

169
00:14:31,930 --> 00:14:32,110
Right .

170
00:14:32,110 --> 00:14:36,370
So one of them was disable Windows Defender.

171
00:14:36,370 --> 00:14:37,910
I'm like, oh, that looks nasty.

172
00:14:37,910 --> 00:14:41,690
So I threw it up into VirusTotal and it was nasty.

173
00:14:41,690 --> 00:14:46,950
So, you know, yeah.

174
00:14:46,950 --> 00:14:54,070
So that was that particular sample, because I'm assuming a lot of places have Windows 10.

175
00:14:54,230 --> 00:14:57,910
Without the .NET framework, I'm like, meh.

176
00:14:58,270 --> 00:15:20,370
So then last night at 5.15pm Pacific Standard Time, like yesterday, like literally yesterday, less than 24 hours before my talk, a friend contacted me and said that his company was willing to let me look at their junk data to go through this as an example.

177
00:15:20,370 --> 00:15:21,570
So I'm like, cool.

178
00:15:21,730 --> 00:15:25,090
Like, yeah, like, I'll totally do that.

179
00:15:25,410 --> 00:15:32,670
But can I do it or can I not do it for, you know, prepping in less than 24 hours to analyze this?

180
00:15:32,670 --> 00:15:33,690
Well, let's see.

181
00:15:33,690 --> 00:15:41,390
Like, it's not unrealistic for enterprise and corporate America for you to get off the wall like crazy ass, you know, last second.

182
00:15:41,390 --> 00:15:43,330
So I'm like, why not?

183
00:15:43,330 --> 00:15:44,170
Let's do this.

184
00:15:44,170 --> 00:15:45,490
You only live once, right?

185
00:15:45,490 --> 00:15:46,390
YOLO.

186
00:15:46,750 --> 00:15:55,390
So I got the sample and I tried to make it as realistic as possible, like pretending your boss comes to you and says, I need this yesterday.

187
00:15:55,390 --> 00:16:06,430
So, you know, and let's say that, I don't know, whatever, I just did the sandbox stuff, OPSEC, blah, blah, blah.

188
00:16:07,810 --> 00:16:13,090
So do whatever you do with your organization, whatever, right?

189
00:16:13,090 --> 00:16:16,490
Everyone has different things that they can and can't do.

190
00:16:16,490 --> 00:16:24,790
So with this sample, I loaded it to any run and VirusTotal already had an entry, and then I loaded it to Malware Bazaar.

191
00:16:24,910 --> 00:16:29,750
And the wonderful thing about Malware Bazaar is that I get extra stuff.

192
00:16:29,750 --> 00:16:34,410
So I load it to Malware Bazaar, I get Joe Sandbox, and I get Cape.

193
00:16:34,410 --> 00:16:47,270
And Cape took a while, like I had to wait until the morning, like probably around 1 p.m., which would be what, 11, 11, yeah, 11 a.m.

194
00:16:47,270 --> 00:16:48,310
Pacific time.

195
00:16:48,570 --> 00:16:53,270
So to look at the results of those, so I just went with what I had.

196
00:16:53,330 --> 00:17:03,730
And, of course, the threat Intel and me knowing that this came from an actual company, you know, I wanted to share additional context with the person that sent it to me.

197
00:17:03,730 --> 00:17:13,010
So I'm like, oh, you know, according to VirusTotal, it does a callout with the DNS traffic to a Nigerian-based hosting company, and I pivoted off that.

198
00:17:13,310 --> 00:17:19,710
And I ended up creating a custom rule for a YARA rule for this particular company.

199
00:17:19,730 --> 00:17:27,070
And interestingly enough, that particular DNS callout was only associated with four other files.

200
00:17:27,070 --> 00:17:35,870
So I did a diff on it and then shared the particular YARA rule that was associated with that and passed it off to my contact.

201
00:17:36,450 --> 00:17:43,570
And so then I go to MITRE ATT&CK, right, and I'm like, oh, MITRE ATT&CK will save the day.

202
00:17:44,070 --> 00:17:46,310
They'll have something on Hawkeye.

203
00:17:46,310 --> 00:17:48,550
That's what the sample ended up being.

204
00:17:48,550 --> 00:17:55,550
And then I go to MITRE ATT&CK, and I'm like, no, they don't have it up there yet.

205
00:17:55,550 --> 00:17:56,050
Why?

206
00:17:56,050 --> 00:17:57,630
My God, why?

207
00:17:57,790 --> 00:18:01,010
So I'm like, okay, what do I do next?

208
00:18:01,010 --> 00:18:04,110
And this is kind of realistic, you know.

209
00:18:04,430 --> 00:18:12,870
So then I'm like, well, let's try to create a repeatable process for this since I have such a short amount of time to make this doable.

210
00:18:12,890 --> 00:18:24,890
And I decided to just use MITRE ATT&CK's framework anyways and analyze it and tactics to guide the research as far as what to look at.

211
00:18:24,890 --> 00:18:32,150
And this is from Joe Sandbox, an output of all the different MITRE ATT&CK variants, right?

212
00:18:32,150 --> 00:18:48,690
But we want specifics, because if I just say native API or process injection or WMI to the red teamers, they'll be like, okay, great.

213
00:18:48,690 --> 00:18:55,190
So I decided to go a little bit of digging.

214
00:18:55,590 --> 00:19:03,950
And with this, the initial access, it was an email with an XE attachment.

215
00:19:04,290 --> 00:19:09,550
And the subject said, invoice detached, invoice attached, right?

216
00:19:09,550 --> 00:19:15,190
And another thing with this particular sample, it can propagate via USB.

217
00:19:15,190 --> 00:19:23,650
So I didn't want to, you know, get too friendly with it, if you know what I mean.

218
00:19:24,050 --> 00:19:34,850
The other good thing, though, is that this particular sender was not a third party recipient or was not a third party of the recipient of the particular email.

219
00:19:35,270 --> 00:19:41,530
And I really love how they set up their attached is the reverse invoice.

220
00:19:41,530 --> 00:19:47,670
So obviously, they might not necessarily have the best English.

221
00:19:47,770 --> 00:19:55,490
I went to one of the domains that was in the email on the upper right-hand corner, the big yellow thing.

222
00:19:55,490 --> 00:19:58,930
That was the FPE2000.it.

223
00:20:00,230 --> 00:20:02,250
Not too exciting.

224
00:20:02,250 --> 00:20:10,130
And then at the bottom is the actual, like, domain from the sending organization.

225
00:20:10,130 --> 00:20:17,970
So I'm not going to comment further on that, but malicious XEs are coming from there.

226
00:20:18,310 --> 00:20:21,630
And it happens to be from Nigeria, too.

227
00:20:21,630 --> 00:20:33,530
So the sender, a company from Nigeria, and DNS call-up to Nigeria that gave me four other samples that were malicious.

228
00:20:33,530 --> 00:20:36,390
So execution.

229
00:20:36,390 --> 00:20:45,910
Obviously, we have user execution of a malicious file, which is the T1204.002.

230
00:20:45,910 --> 00:20:47,590
So we have that.

231
00:20:48,090 --> 00:20:50,710
And then we have WMI.

232
00:20:50,710 --> 00:21:01,990
So specifically, what it is about WMI is that it checks if the AV antivirus firewall program is installed.

233
00:21:01,990 --> 00:21:08,290
As you can see here, it has select from antivirus product, select from firewall product.

234
00:21:10,250 --> 00:21:13,390
And with this, I used it as an experiment.

235
00:21:13,390 --> 00:21:19,450
And here's the process that I came up with that I repeated for each and every single tactic.

236
00:21:21,610 --> 00:21:26,010
Basically, I look at Joe's sandbox and the MITRE attack section.

237
00:21:26,010 --> 00:21:33,390
And then I look at the specific entry in Joe's sandbox, as far as the detailed information you can see there in that picture.

238
00:21:33,670 --> 00:21:40,430
And then I go to Atomic Red Team to see if they have the particular technique available.

239
00:21:40,430 --> 00:21:44,630
And I look at the YAML contents of that particular file.

240
00:21:44,630 --> 00:21:47,970
And then I Google what isn't there.

241
00:21:47,970 --> 00:21:51,200
So here's an example of that.

242
00:21:51,510 --> 00:21:54,030
So Atomic Red Team has...

243
00:21:54,030 --> 00:22:02,050
When I looked for the T1047 for the WMI, I didn't find specifically what I was looking for.

244
00:22:02,050 --> 00:22:11,610
But later, like a lot later in the process, I found what I needed in T1518.001.

245
00:22:11,930 --> 00:22:14,750
And put that right up there at the bottom.

246
00:22:14,750 --> 00:22:20,310
And then prior to that, I did a little bit of Stack Overflow searching.

247
00:22:20,310 --> 00:22:22,270
And also found a similar command.

248
00:22:22,270 --> 00:22:23,910
I don't know if it works or not.

249
00:22:23,910 --> 00:22:26,730
I would have to do testing on that.

250
00:22:26,730 --> 00:22:32,110
But I have that information available to provide to Red Team to cut down their research time.

251
00:22:33,030 --> 00:22:35,550
So next, we have the Native API.

252
00:22:35,570 --> 00:22:39,990
And specifically, this is related to .NET source code references.

253
00:22:40,370 --> 00:22:44,470
And I was like, what the heck do they mean by that?

254
00:22:44,470 --> 00:22:47,090
So I looked that up at the bottom.

255
00:22:47,090 --> 00:22:51,590
And as you can see, it comes from particular XEs.

256
00:22:51,630 --> 00:22:56,410
And I'm like, okay, so I searched through the whole analysis report.

257
00:22:56,410 --> 00:22:59,630
And it was still not helpful.

258
00:22:59,810 --> 00:23:02,490
So then I went to Atomic Red Team.

259
00:23:02,490 --> 00:23:06,390
And as you can see here, I put the big arrow.

260
00:23:06,850 --> 00:23:12,490
They have the .NET Framework version 4.0, whatever.

261
00:23:12,490 --> 00:23:13,990
And I searched that.

262
00:23:13,990 --> 00:23:16,790
And then I found a command line argument.

263
00:23:16,790 --> 00:23:23,670
But no qualifiers or information behind that.

264
00:23:23,790 --> 00:23:28,190
So there is an Atomic Red Team for it.

265
00:23:28,190 --> 00:23:36,690
But it doesn't necessarily state how to engage the different APIs and leverage those.

266
00:23:36,690 --> 00:23:38,630
But they're there.

267
00:23:38,630 --> 00:23:42,270
So I'm like, okay, I'll include that for context.

268
00:23:43,130 --> 00:23:44,970
Persistence is next.

269
00:23:45,350 --> 00:23:54,110
So one of the ways that this particular sample gets persistence is through trying to load missing DLLs.

270
00:23:54,110 --> 00:24:00,850
And I searched in the sandbox report and found that were WER fault?

271
00:24:00,850 --> 00:24:02,330
I don't know if I'm saying that right.

272
00:24:02,330 --> 00:24:02,870
Sorry.

273
00:24:03,790 --> 00:24:06,730
And I was like, oh, this is interesting.

274
00:24:06,730 --> 00:24:08,850
I'm like, interesting.

275
00:24:08,850 --> 00:24:15,610
I'm like, I wonder if that particular XE is actually legitimate or what's going on with it.

276
00:24:15,750 --> 00:24:18,990
So there was a hash for this particular sample.

277
00:24:18,990 --> 00:24:21,110
And I threw it into VirusTotal.

278
00:24:21,110 --> 00:24:22,650
And it came back clean.

279
00:24:22,650 --> 00:24:26,610
So I'm like, okay, well, that's interesting.

280
00:24:27,790 --> 00:24:29,810
Okay, so I'll put that down.

281
00:24:29,810 --> 00:24:32,970
There is an atomic test, but it's based on PowerShell.

282
00:24:34,350 --> 00:24:37,210
So next is Privesk.

283
00:24:37,210 --> 00:24:42,090
And it does include the previous DLL side loading technique that I had up there.

284
00:24:42,090 --> 00:24:47,550
Plus it also had process injection.

285
00:24:47,550 --> 00:24:50,430
So there was a lot of process injection with this one.

286
00:24:50,430 --> 00:24:52,670
And there's an atomic test for it, too.

287
00:24:52,670 --> 00:25:01,250
And below here, there was a command line argument down at the bottom related to process injection here.

288
00:25:01,250 --> 00:25:06,130
So I provided that as context for the red teamers.

289
00:25:06,350 --> 00:25:07,550
Defense evasion.

290
00:25:07,550 --> 00:25:09,910
It had a ton of defense evasion.

291
00:25:09,910 --> 00:25:18,470
Everything from invalid code citing, software packing, sandbox evasion, lots.

292
00:25:18,830 --> 00:25:25,730
And I pulled out the ones that might be helpful to emulation exercises.

293
00:25:25,730 --> 00:25:27,650
One was masquerading.

294
00:25:27,650 --> 00:25:31,510
So this one, it creates files inside the user directory.

295
00:25:31,510 --> 00:25:40,030
So when I looked up atomic red team, they didn't have information specific to that.

296
00:25:40,030 --> 00:25:41,970
There were a bunch of other tests.

297
00:25:42,390 --> 00:25:45,570
But that is the specific user directory.

298
00:25:45,570 --> 00:25:50,570
So I'm assuming they could take care of that.

299
00:25:50,570 --> 00:26:00,110
The next one, modify registry, stores large binary data to the registry and then it modifies the registry key.

300
00:26:01,550 --> 00:26:04,370
And hidden files and directories.

301
00:26:04,370 --> 00:26:08,110
There's key that's created or modified.

302
00:26:09,990 --> 00:26:12,770
And obfuscated files.

303
00:26:12,770 --> 00:26:18,590
So this one, I assumed that they were talking about the process environment block.

304
00:26:18,590 --> 00:26:23,270
Since that's pretty standard with the exploit dev.

305
00:26:23,270 --> 00:26:28,710
And trying to walk that in order to find the address of kernel 32 DLL.

306
00:26:28,710 --> 00:26:32,190
So I assume that's what the shell code was about.

307
00:26:32,810 --> 00:26:37,970
Especially here it says contains functionality to read the PEB.

308
00:26:38,290 --> 00:26:41,630
So that was just my educated guess.

309
00:26:42,330 --> 00:26:44,310
Regarding the shell code.

310
00:26:44,990 --> 00:26:46,250
Credentialed access.

311
00:26:46,250 --> 00:26:47,510
There was a ton of that.

312
00:26:48,110 --> 00:26:50,330
Credential dumping, all of that.

313
00:26:51,350 --> 00:26:53,910
Takes credentials from web browsers.

314
00:26:53,910 --> 00:26:56,490
There is an atomic test for that as well.

315
00:26:56,610 --> 00:26:58,090
And then discovery.

316
00:26:58,270 --> 00:26:59,930
There's a couple of different things.

317
00:26:59,930 --> 00:27:01,170
So process discovery.

318
00:27:01,170 --> 00:27:03,230
There's an atomic test available.

319
00:27:03,610 --> 00:27:05,730
Remote system discovery.

320
00:27:05,730 --> 00:27:07,470
Atomic test available.

321
00:27:07,470 --> 00:27:09,770
Atomic test for this as well.

322
00:27:09,770 --> 00:27:11,390
And I put it at the bottom.

323
00:27:11,390 --> 00:27:13,450
Machine GUID.

324
00:27:14,250 --> 00:27:15,530
Lateral movement.

325
00:27:15,670 --> 00:27:19,190
It has the replicate via USB.

326
00:27:19,510 --> 00:27:22,670
Obviously, yeah.

327
00:27:23,150 --> 00:27:26,210
I don't know if they're using it to pivot or whatever.

328
00:27:26,210 --> 00:27:31,850
It just seems like it's a standard stealer for credentials to use later.

329
00:27:32,470 --> 00:27:34,630
Credential collection.

330
00:27:34,650 --> 00:27:39,050
So key logging and then data from local system is another one.

331
00:27:40,650 --> 00:27:42,170
T1005.

332
00:27:43,090 --> 00:27:46,690
And then archived collected data.

333
00:27:46,690 --> 00:27:55,210
So with this, I'm assuming they meant that they would either compress or encrypt the data prior to exfil.

334
00:27:55,210 --> 00:28:01,370
So that's good info for the red teamers to use in their exercises.

335
00:28:01,370 --> 00:28:04,990
Of course, also, too, they take the clipboard data.

336
00:28:05,530 --> 00:28:07,470
Local e-mail collection.

337
00:28:07,470 --> 00:28:10,730
And there's an actual atomic test for this as well, too.

338
00:28:11,390 --> 00:28:18,130
And all of the specific folders that were accessed in order to get the contents.

339
00:28:18,130 --> 00:28:19,410
And I provide that.

340
00:28:20,330 --> 00:28:21,930
So C2.

341
00:28:23,670 --> 00:28:25,230
Encrypted channel.

342
00:28:25,390 --> 00:28:31,210
So I know that Jorge has the C2 matrix along with Bryce and Bort.

343
00:28:31,210 --> 00:28:38,410
And so they have a lot of different fun things that you can pick through to be like, okay, I need an encrypted channel.

344
00:28:38,410 --> 00:28:42,990
So that will be really easy for you to go through.

345
00:28:43,730 --> 00:28:47,950
And there is an atomic test available for these as well.

346
00:28:48,510 --> 00:28:49,590
Exfiltration.

347
00:28:49,590 --> 00:28:55,010
I assume that they exfil the encrypted or compressed data.

348
00:28:55,070 --> 00:28:56,710
So there is that.

349
00:28:56,710 --> 00:28:58,830
That's what I put as exfiltration.

350
00:28:58,830 --> 00:28:59,490
Impact.

351
00:28:59,490 --> 00:29:06,830
There doesn't necessarily seem to be an impact other than stealing creds and private information.

352
00:29:06,830 --> 00:29:10,930
So, you know, no ransomware type anything.

353
00:29:10,930 --> 00:29:14,110
And I wanted to add additional context as well.

354
00:29:14,110 --> 00:29:20,830
So I decided to look at the Yara rules that fired on this particular sample.

355
00:29:20,830 --> 00:29:29,550
And as you can see, there's consistent hits with this particular rule from Malware Bazaar.

356
00:29:29,770 --> 00:29:32,070
And then I decided to go digging a little bit.

357
00:29:32,070 --> 00:29:34,790
And I'm like, huh, what is this rule about?

358
00:29:34,830 --> 00:29:39,430
So I found a link to it on a GitHub.

359
00:29:39,830 --> 00:29:42,350
And same author, same all of that.

360
00:29:42,350 --> 00:29:44,630
And it looks like it was made in 2015.

361
00:29:45,010 --> 00:29:58,690
And it looks like they're using the same string of the holder mail.txt, which was also a command line argument, as you can see down here at the bottom, since at least 2015.

362
00:29:58,710 --> 00:30:08,590
So I'm like, oh, that would probably be good to include in the emulation exercise since that hasn't changed in, what, five years?

363
00:30:09,210 --> 00:30:31,590
The other thing is so the HTTP traffic doesn't have a header, I have different examples here of files written and then the process tree too, if they want to try to emulate that as well for, like, security tools and all of that for detection purposes.

364
00:30:31,590 --> 00:30:33,490
It dropped 11 files.

365
00:30:33,490 --> 00:30:41,330
And I included the different folders that they got dropped to and other characteristics.

366
00:30:41,330 --> 00:30:43,710
So I thought that this was interesting.

367
00:30:43,710 --> 00:30:45,450
They used port zero.

368
00:30:45,830 --> 00:30:51,190
And so I just included stuff that I'm like, huh, this looks really interesting.

369
00:30:51,190 --> 00:30:59,730
They used DNS over HTTPS and things like that so that red team can kind of pick and choose what they want and don't want.

370
00:31:01,030 --> 00:31:05,650
And so basically this was literally junk data.

371
00:31:05,650 --> 00:31:07,110
Like, no one cared about it.

372
00:31:07,110 --> 00:31:08,310
It was blocked.

373
00:31:08,310 --> 00:31:10,190
Like, who cares, right?

374
00:31:10,210 --> 00:31:14,030
But the org was being targeted with it.

375
00:31:14,030 --> 00:31:37,890
So just a little bit, what, less than 24 hours that I spent with this particular sample, we got all of this information out of it, was able to map it back to Atomic Red Team or Google and, like, you know, stack overflow and all of that and get somewhat of some commands and behaviors,

376
00:31:37,890 --> 00:31:43,370
TTPs, associated with this that they can test within their own environment.

377
00:31:43,370 --> 00:31:52,370
And here's just some of the stuff that they can get from this data that's essentially junk.

378
00:31:52,370 --> 00:31:53,610
I mean, that's pretty good.

379
00:31:53,610 --> 00:32:03,170
They got a Yara rule out of it, custom, made by me, from threat actors that they're actively being targeted with.

380
00:32:03,170 --> 00:32:15,510
They got basically kind of a purple team exercise where, you know, if you know it's using this or it's doing that, you can look at your defenses prior to that.

381
00:32:15,510 --> 00:32:18,430
Do you have, you know, WMI, all of that.

382
00:32:18,590 --> 00:32:34,290
So building out a purple team exercise around this and working with adversary emulation teams, whether that's a dedicated person or a team or blue teamers filling the red team, who knows, right?

383
00:32:34,290 --> 00:32:38,090
Organizations have so many different things going on.

384
00:32:39,170 --> 00:32:57,110
So in summary, I'm going to leave it to you guys to decide if you think that junk data, essentially blocked data, can provide value to your organization and whether or not you can use that blocked data or even delivered data.

385
00:32:57,110 --> 00:33:01,210
You see what I do with blocked data, imagine delivered, right?

386
00:33:02,110 --> 00:33:13,210
So, you know, whether or not you can kind of tailor and use this information that's specific to your organization that's being targeted.

387
00:33:14,010 --> 00:33:22,290
Having the MITRE ATT&CK heat map and knowing where your coverage is in your environment that people talk about, right?

388
00:33:23,150 --> 00:33:25,450
Cyber War Dog talks about that.

389
00:33:25,450 --> 00:33:28,370
Olaf, like a ton of people.

390
00:33:28,430 --> 00:33:35,170
And so knowing that you can know where your weaknesses are, where your strengths are, where you have visibility, where you don't have visibility.

391
00:33:35,170 --> 00:33:37,290
And you can take this information.

392
00:33:37,290 --> 00:33:46,710
And as a threat intel analyst, you can see that you don't have to buy two computers to get some of this information.

393
00:33:47,010 --> 00:33:54,310
I really loved the Cape Sandbox and also Joe Sandbox and Malware Bazaar.

394
00:33:54,310 --> 00:33:57,250
Absolutely love, love them.

395
00:33:57,250 --> 00:33:59,170
Just combining all of it.

396
00:33:59,170 --> 00:34:09,330
And then also to the different sandboxes, they're not like I got different data from different ones, even though it was the same sample.

397
00:34:09,470 --> 00:34:11,750
So I just kind of compiled it all.

398
00:34:11,750 --> 00:34:20,710
And then some of the analysis I did on my own, I added additional TTPs that weren't on the actual heat map that I showed you at the beginning.

399
00:34:20,870 --> 00:34:25,970
So there's a lot that you can do with this based upon your organization.

400
00:34:25,970 --> 00:34:33,970
You can also create a threat library or threat actor dossiers, kind of, even though it's malware.

401
00:34:33,970 --> 00:34:37,950
But you can kind of start to paint a picture over time.

402
00:34:37,950 --> 00:34:46,790
So you see the Nigerian infrastructure and a Nigerian company sending you maliciousness.

403
00:34:46,990 --> 00:34:49,250
I'm not pointing fingers.

404
00:34:50,130 --> 00:35:00,130
So you can start to get a more holistic view of your threat landscape and what they could potentially be interested in.

405
00:35:00,370 --> 00:35:05,930
Obviously, if they wanted to disrupt your services, I mean, yeah.

406
00:35:05,930 --> 00:35:09,010
So I could talk a really long time about that.

407
00:35:09,010 --> 00:35:16,750
But I will leave that up to your conclusion and what you find valuable to your organization.

408
00:35:16,750 --> 00:35:20,910
And I just want to thank you so much for attending my talk.

409
00:35:21,010 --> 00:35:23,010
And that's it.

410
00:35:23,430 --> 00:35:24,190
Thank you.

411
00:35:24,190 --> 00:35:25,410
Enjoy DEF CON.

412
00:35:25,410 --> 00:35:27,090
And thank you.

413
00:35:27,870 --> 00:35:32,310
Thank you very much, Cheryl, for that wonderful presentation and talk.

414
00:35:32,810 --> 00:35:46,370
And as always, we recommend that you go to TrackTalk1 to direct your questions for the presenter on our Blue Team Village Discord.

415
00:35:47,030 --> 00:35:54,310
And if you have any questions, I'm sure she will be able to answer them.

416
00:35:54,310 --> 00:35:56,990
And I'm just going to look through real quick.

417
00:35:56,990 --> 00:35:58,970
I don't see any at the moment.

418
00:35:59,450 --> 00:36:01,290
So thank you very much.

419
00:36:01,410 --> 00:36:02,310
Thank you.