Okay. Welcome to Project Obsidian Kill Chain 1 walkthrough.
This will be an endpoint forensics walkthrough of the Kill Chain 1 attack simulation for Project Obsidian.
Before we get into talking about the Kill Chain and the artifacts that we're going to look at,
I'd like to give a little bit of background about Project Obsidian and a little bit of clarity on what this particular presentation will be.
So Project Obsidian is a project prior to Project Obsidian.
It was called Project Capstone. It's been several years in the making.
We've been putting this particular, the Obsidian project, together for about 10 months.
And Project Obsidian is a way of holistically looking at,
and I think it's a way of looking at,
So the engineering team for Project Obsidian put together a company, a fake company in AWS.
We staffed it with employees, with fake employees, and then ran through an attack scenario.
The red team attacked the environment, and you'll see that it's,
it's a very, it's a very close simulation to what an attack would look like.
And then the additional Obsidian teams, Incident Response, Forensics,
malware reverse engineering, cyber threat intelligence, and cyber threat hunting,
all looked at this environment and created education on how each of these teams would approach an attack.
This particular walkthrough that we're going to look at,
is Endpoint Forensics.
Now the Forensics team looked at the SIM, they looked at network detection, and also at Endpoint Forensics.
This is for Kill Chain 1.
There were three Kill Chains, Kill Chain 1, Kill Chain 2, and Kill Chain 3.
So this presentation is very targeted.
It's the Kill Chain 1 Endpoint Forensics, just looking at the forensics on the endpoints.
To do this,
we used Velociraptor, Velociraptor is a forensics collection tool.
So we ran Velociraptor on the machines in the environment, and then analyze those machines.
We built a timeline for the series of events and attack attacks.
And then we looked at the artifacts.
I'm going to do a demo of the tools at the end.
But it's a good idea.
And it's important to realize that this really isn't a presentation to do, to look at just timelining.
In fact, timelining is not the focus of this presentation.
We're going to be looking at the artifacts that we extracted, how you would parse and analyze those artifacts, and the conclusions that you would draw from them.
So getting started, I want to get the timeline understood.
We're looking at
There'll be three screens here.
Starting with February 12.
The attack actually started a little bit before this, but to keep the scope small, we're going to be looking at February 12.
First, we see that malicious email was sent in the environment.
And we're looking at an employee called Karen Mutants, who opened that email and executed the malicious attachment.
Which then executed malicious powershell in the environment.
Moving further into the timeline, we'll see that the actor, once they gained access to the network or access to the system, moved laterally and dropped additional malware on the machine.
Finally, we'll see that we looked at a number of workstations.
Workstation 1 and Workstation 2 are what we're going to cover here.
But we also looked at Workstation 3, and we didn't find anything.
So it's an important point.
I wanted to highlight it in this presentation that you may initially suspect an endpoint.
You may do a full analysis on it and not find anything there, and that's okay.
So getting into the artifacts and the conclusions we can draw from them.
The first thing that we find is that a malicious powershell script was executed in the environment.
We see this in the powershell event viewer log.
And it jumps out at us because it's using this, you know, it's using a hidden execution.
And the powershell script is obfuscated.
So we're going to grab that.
Data from this event log.
And we'll throw it into into Cyber Chef.
Cyber Chef is a great tool for deobfuscating and analyzing data.
In this case, the data went through several iterations of deobfuscation.
And we'll do a demo of that a little bit later.
Where we finally came to the conclusion.
That this was in the bottom.
You'll see the bottom right.
You'll see the actual C2 server where malware was downloaded from.
That is malwarelove.xyz.
And if we do an NSLOOKUP on that domain, it resolves to 3.13219216.
Now, why is this important?
And why is this one of the first things?
Why is this one of the first steps we're going to do?
Well, that's because now we have at least some indication of the attacker's activity.
We can now take these indicators compromised.
We can scan our entire environment for these indicators.
We can add them to our IDS systems.
We can add them to our endpoint detection systems.
And we can monitor.
Not only to see if there's been further activity in the environment.
But we can alert if this actor moves anywhere else in the environment.
So this is a very important first step when we are looking at an endpoint and discovering what happened on that endpoint.
The next thing we're going to look at here is the malicious email itself.
So at this point, we've learned.
From the incident response folks that a malicious email was sent to several people in the environment.
That email had an attachment, which we can see is a base64 encoded MIME attachment.
We can also throw that into CyberChef.
And decode that and save it.
This will be our malicious document that we can send to the malware reverse engineering folks.
And they can tell us more about what this document does.
And maybe produce more IOCs from it.
The next thing that we're going to find in the environment.
Is that the person that received this email also enabled macros.
And we see this in their registry.
This is a sysmon log entry.
Showing this.
But if you looked in the user's registry.
You would see that they had enabled macros.
This is another look at it.
And I bring this up because what we're going to do is we're going to take a lot of this data and put it into an easy to read format.
We use a couple of tools for that.
Chainsaw is the tool that we're going to run.
To look at the event viewer logs.
Chainsaw uses sigma rules.
And it will present what it finds in the event logs that are worth investigating.
We take that data.
Which can be produced in comma separated values.
We take that data and we throw it into a reporting tool called ACH report.
And that gives us kind of a nice view.
A little bit easier to look at than just all the data loaded up into Excel.
The next thing we find in the environment is since we've run Velociraptor and gathered all of this evidence.
Velociraptor collected the network connections and enhanced them.
So we see that there was indeed a PowerShell execution.
We identified that it was process ID 7036.
Endpoint 172.16.50.131.
Reaching out to our C2 server 3.132.196.16.
And we can corroborate that by looking at the memory itself.
So one of the other things we did when we collected this endpoint was we collected a snapshot of the memory.
And then running volatility against that memory collection.
We can see not only that Velociraptor found this network connection.
But we can actually see it in memory.
The next thing we're going to look at since we now know that process ID 7036 is one of our attacker's processes.
We can look at the command line.
So we're going to use volatility.
And we're going to list out all the command lines that we'll run on this machine.
And filter it by process ID 7036.
And sure enough, we find process ID 7036 was PowerShell.
And it has this clearly malicious PowerShell script that was run.
Obfuscated.
We can then take that.
We won't actually do that here.
But I'll leave that for the exercise of the watcher.
To extract this data.
Throw it into CyberChef.
And decode it.
One of the additional things that we're going to do when we're looking in the environment is we're going to ask some common questions.
Right?
And in this case, we ask the common question, hey, are there any executables in temp directories?
It's a common thing that attackers do.
And in this environment, we find, you know, a gold mine of attackers.
We find an attacker activity.
We find a Metasploit.
A Covenant, which is a post exploitation framework.
A Covenant agent.
And PingCastle, which is a tool used to look at Active Directory.
The next thing we're going to see, since we know from this screen that cleanup.exe is malicious, we're going to look and see, do we find any evidence of persistence?
And, of course, in our telemetry, using the Velociraptor Autoruns artifact, we see that, sure enough, a task was scheduled running cleanup.exe.
And in a task called Daily Magnum Tempus IT Cleanup.
Additionally, looking through the data.
We see evidence of enumeration in the environment and for lateral movement.
Right?
So this is coming from the Sysmon data, extracted Sysmon data.
You see the event ID is one.
This comes from running Chainsaw against the event logs and then taking that Chainsaw data and displaying it in a format that's a little bit easier to read.
So now that we've got a pretty good idea of the kinds of data that we're going to see in this environment, I'd like to walk through a short demonstration of some of the actual tools that we use to do this.
So here we see, as we saw earlier, CyberChef, right?
And from CyberChef, what we're going to do here.
Is look at this PowerShell event log, right?
And I've highlighted here.
I'm going to grab, I'm going to copy this data from the PowerShell event log.
And I'll put it into CyberChef.
And I've already loaded the recipe up.
And we're going to make all of this data available, including the recipe.
But I've already loaded the recipe up.
Rather than walk through, you know, each piece of the recipe, I'm just going to turn the different pieces on to show you how we would decode this.
And you can take time in your environment to do the same thing.
But first thing that we see, this is obviously Base64 encoded.
So we're going to Base64 decode it.
And looking at the output.
We see that it is Unicode, right?
So let's remove the null bytes, the Unicode null bytes.
Get a nice, better picture.
And within this decoded data, we see there is more Base64 decoding.
But it's in the middle of the execution.
So we want to extract out the, just the Base64.
So we're going to use a regular extract.
This is an expression that extracts out just the Base64 data.
Now, after we've done that, we can now Base64 decode it again.
And we're going to see what looks like an archive of some sort, right?
We're going to inflate that archive, right?
It's, it's, it's, I think zip encoded.
I'm not entirely sure which encoding.
But again, we're going to see more obfuscation, right?
So this is common.
You're going to see obfuscation with an obfuscation with an obfuscation.
So the first thing we do to make this easier to read is remove all of the spaces, right?
After we've removed the spaces, we can then use another regular expression to extract out just the data that we're looking for.
And remove all of the, all of the execution piece, right?
So another regular expression.
Now we've got the data in decimal.
So we're going to take that decimal and turn it into ASCII, right?
Now that it's in ASCII, we can see that it's further obfuscated with these plus signs, right?
Further activity by the attacker to hide.
So let's get rid of the plus signs.
And we get now a better picture of what the actual malware looks like.
And we'll run the beautifier.
And we see what we had seen in our earlier slide of this code reaching out to its C2 server to download malware.
The next thing we're going to look at is the actual email
that was sent to Amanda Nunsis.
And there's really not a lot to learn here other than we can see in the base 64 encoding, the attachment.
And we can then copy and paste that again into CyberChef, which I'm not going to do.
But we could copy and paste that into CyberChef.
And then provide that mail doc to Amanda.
And we can then send that back to our reverse engineers.
The next thing I'd like to do is look at some of the other things that we talked about, right?
So one of the things we talked about is on workstation one that the trust records.
Now this is something called ACH report.
It's simply a tool that runs a lot of other tools and then presents the data in a common, easy to read format.
So this makes it a little bit easier for me to present the data.
This tool doesn't do the extraction.
It's really just a reporting tool.
So we're going to look at the enablement.
Of trust record, the enable of the enablement of macros on workstation one.
And again, what we see is that this is actually.
Chainsaw output.
When we run chainsaw against our event logs, we see that.
That chainsaw detected that this.
Register key was changed and it flags it as a Windows registry trust record modification.
So again, important to remember the tools here.
You're extracting the event logs.
We're running chainsaw against them.
And then we're just presenting that data in a, in a little bit easier to view format.
On workstation two, a couple of things we're also going to look at again.
This is just looking at some of the data we've already presented, but I wanted to show it from the perspective of using the tooling.
We're going to look at.
Files that ran out of temp directories.
So.
So in this case, what we see, what we have here is.
This tool ACH report.
Took the master file table.
We've extracted the master file table.
From this endpoint.
We ran it through a program called MFT dump.
That, that program MFT dump.
Takes the master file table.
And, and.
Parses it into comma separated values.
Then what we did was we simply searched.
In that comma separated file.
And asked.
Are there any files that are run out of temp directories?
And this is a common question that we ask.
And we see.
Again, interpreter.
Cleanup.
And p.exe, right?
These three.
Indications of.
Math these, these three.
Pieces of malware.
Right.
And in particular.
We noticed cleanup.
The post exploitation.
Tool.
We're going to look at cleanup.
Look for occurrences of cleanup.
And again, we see the same thing we saw earlier.
In the presentation.
That cleanup was added as a task.
For persistence.
The last thing we're going to look at.
In the environment.
Is.
The.
Lateral movement.
And.
I'm just going to choose.
Local group.
You can search for a number of things.
But here we're seeing.
That.
Sysmon identified.
Process ID one.
Of.
The actor running.
Who am I?
Running net.
Exe to enumerate.
The administrators.
Looking at.
At.
The domain settings.
And so.
This is again.
From.
The.
Sysmon logs.
But this is chainsaw.
Chainsaw.
Has.
Has.
We've pointed chainsaw.
At.
The.
Event logs.
And chainsaw.
Identified.
This activity.
As.
This net.
Exe.
Execution.
Okay.
Going back to our presentation.
Wrapping it up.
Here is a list of the tools.
That we used.
To do this.
Investigation.
Velociraptor.
To gather the data.
With PMEM.
To collect the memory.
Facility.
To view.
The data.
And.
Cyber chef.
Sysmon.
Auto runs.
MFT dump.
Chainsaw.
And ACH report.
And before I.
Before I.
End the presentation.
Let's.
Go back.
A second.
And look.
At that memory.
Right.
One thing.
I did not demo.
That I think.
Is.
Is worth.
Seeing.
Okay.
So.
Let's.
Look at.
Memory.
I've.
Just.
Created.
A very small.
Batch.
File.
To show.
Volatility.
Running.
Right.
The first thing.
We're going to do.
Is look at the memory.
We're looking for.
Process ID.
7036.
And.
This.
Is.
Again.
What we saw.
In the presentation.
Just.
One.
Wanted.
To give.
Everyone.
Watching.
This.
This.
Video.
Feel.
For.
What.
This.
Looks.
Like.
Again.
You.
Can.
Run.
These.
Commands.
Manually.
Or.
Wrap.
Them.
Into.
A.
Batch.
File.
And.
All.
We're.
Doing.
Is.
Running.
The.
Net.
Scan.
Plugin.
For.
Volatility.
And.
Filtering.
On.
Process.
ID.
7036.
And.
When.
This.
Is.
Done.
We'll.
Run.
The.
Second.
Command.
Which.
Will.
Look.
For.
The.
Command.
Line.
And.
Not.
Looking.
At.
All.
The.
Command.
Lines.
If.
We.
Just.
Ran.
Command.
Line.
The.
Command.
Line.
We.
Would.
See.
All.
The.
Command.
Lines.
But.
We're.
Going.
To.
The.
List.
Of.
Tools.
That.
We.
Use.
And.
An.
Invitation.
If.
You.
Want.
To.
Learn.
More.
About.
Blue.
Team.
Village.
Please.
Visit.
Us.
At.
Our.
Discord.
We.
Have.
Several.
Channels.
Dedicated.
To.
Lots.
Of.
Different.
Blue.
Team.
Topics.
Including.
Forensics.
We're.
Going.
To.
Make.
All.
Of.
The.
Data.
That.
I've.
Presented.
Not.
Only.
Just.
This.
Data.
But.
The.
Other.
Kill.
Chains.
The.
Sim.
Data.
That.
We.
Have.
There.
Will.
Be.
A.
Walkthrough.
On.
The.
Sim.
And.
And.
IBS.
Walkthroughs.
We're.
Going.
To.
Be.
Making.
All.
Of.
That.
Data.
Available.
To.
The.
Community.
You.
Can.
Use.
Your.
Tools.
To.
Look.
Through.
The.
Data.
You.
Can.
Use.
That.
Data.
For.
Learning.
More.
In.
Other.
Tools.
Are.
Released.
All.
The.
Time.
Having.
This.
Data.
Available.
To.
You.
Allows.
You.
To.
Take.
Those.
That.
Data.
And.
Test.
It.
Against.
New.
Tools.
Test.
It.
Against.
Your.
Existing.
Come.
Join.
Us.
On.
The.
Blue.
Team.
Village.
Discord.
And.
That.
Concludes.
This.
Presentation.
Of.
The.
Kill.
Chain.
One.
Walkthrough.