1
00:00:02,720 --> 00:00:04,960
hello and welcome to the projects

2
00:00:04,960 --> 00:00:06,240
obsidian

3
00:00:06,240 --> 00:00:08,720
uh endpoint forensics kill chain three

4
00:00:08,720 --> 00:00:11,679
walkthrough uh before we go through

5
00:00:11,679 --> 00:00:14,559
the actual walkthrough uh i'd like to

6
00:00:14,559 --> 00:00:16,960
draw a little context around what this

7
00:00:16,960 --> 00:00:18,640
presentation is

8
00:00:18,640 --> 00:00:20,240
so first of all what is product project

9
00:00:20,240 --> 00:00:21,439
obsidian

10
00:00:21,439 --> 00:00:24,080
obsidian is a project that the blue team

11
00:00:24,080 --> 00:00:25,519
village has been working on for a few

12
00:00:25,519 --> 00:00:27,119
years now

13
00:00:27,119 --> 00:00:30,400
it is designed we created a fictitious

14
00:00:30,400 --> 00:00:31,840
company

15
00:00:31,840 --> 00:00:34,480
we staffed that fictitious company with

16
00:00:34,480 --> 00:00:35,920
employees

17
00:00:35,920 --> 00:00:38,719
and then we had uh the red team the

18
00:00:38,719 --> 00:00:41,920
project obsidian red team attacked that

19
00:00:41,920 --> 00:00:43,280
that network

20
00:00:43,280 --> 00:00:47,200
and from there we did incident response

21
00:00:47,200 --> 00:00:49,680
forensic examination malware reverse

22
00:00:49,680 --> 00:00:51,520
engineering cyber threat intelligence

23
00:00:51,520 --> 00:00:54,559
and cyber threat hunting this

24
00:00:54,559 --> 00:00:56,480
presentation today

25
00:00:56,480 --> 00:00:59,520
is really the endpoint forensics part of

26
00:00:59,520 --> 00:01:02,399
it so the forensics team uh will have

27
00:01:02,399 --> 00:01:05,119
several presentations this one is kill

28
00:01:05,119 --> 00:01:06,799
chain three

29
00:01:06,799 --> 00:01:08,880
and it covers only looking at the

30
00:01:08,880 --> 00:01:11,600
endpoints from a forensic perspective

31
00:01:11,600 --> 00:01:14,000
to do that we did collections on the

32
00:01:14,000 --> 00:01:17,040
machines in the environment after the

33
00:01:17,040 --> 00:01:19,119
environment was attacked

34
00:01:19,119 --> 00:01:20,479
i'll show a little bit of a timeline

35
00:01:20,479 --> 00:01:22,240
we're not going to focus on the timeline

36
00:01:22,240 --> 00:01:23,600
because mostly what i want to show in

37
00:01:23,600 --> 00:01:24,960
this presentation

38
00:01:24,960 --> 00:01:28,080
is the artifacts how we would look at

39
00:01:28,080 --> 00:01:30,159
the artifacts how we would uh draw

40
00:01:30,159 --> 00:01:32,479
conclusions from those artifacts

41
00:01:32,479 --> 00:01:35,600
and then a small demo of

42
00:01:35,600 --> 00:01:37,920
what it looks like when you would

43
00:01:37,920 --> 00:01:41,840
actually do the analysis

44
00:01:43,840 --> 00:01:45,360
uh here we're seeing the timeline we'll

45
00:01:45,360 --> 00:01:46,960
see several slides and i'm not going to

46
00:01:46,960 --> 00:01:48,560
really cover these but i just wanted to

47
00:01:48,560 --> 00:01:50,240
cover

48
00:01:50,240 --> 00:01:51,600
the kinds of things that we'll see in

49
00:01:51,600 --> 00:01:54,720
today's presentation we'll see some

50
00:01:54,720 --> 00:01:56,560
some bloodhound being run in the

51
00:01:56,560 --> 00:02:00,079
environment smb scanning uh connections

52
00:02:00,079 --> 00:02:02,880
from a machine called rdpo1 to domain

53
00:02:02,880 --> 00:02:04,000
controllers

54
00:02:04,000 --> 00:02:05,439
we're going to focus mostly on three

55
00:02:05,439 --> 00:02:07,119
machines uh

56
00:02:07,119 --> 00:02:09,679
rdpo1 which is the source of where

57
00:02:09,679 --> 00:02:13,120
the attacks came from and then uh

58
00:02:13,120 --> 00:02:15,200
some activity on the domain controllers

59
00:02:15,200 --> 00:02:17,360
we'll see some malicious admins being

60
00:02:17,360 --> 00:02:19,599
added via automation we'll see some

61
00:02:19,599 --> 00:02:21,760
evidence that the actor tried to ex-fill

62
00:02:21,760 --> 00:02:24,959
some data some lateral movement dumping

63
00:02:24,959 --> 00:02:29,280
of credentials via dumping lsas

64
00:02:29,280 --> 00:02:30,400
and then

65
00:02:30,400 --> 00:02:34,640
ntlm downgrade to allow

66
00:02:34,720 --> 00:02:37,360
less secure hashes to be dumped which

67
00:02:37,360 --> 00:02:39,040
could be cracked offline

68
00:02:39,040 --> 00:02:43,679
and then security logs being cleared

69
00:02:44,000 --> 00:02:46,640
excuse me so let's see the first piece

70
00:02:46,640 --> 00:02:48,480
of evidence that we notice in this

71
00:02:48,480 --> 00:02:49,760
environment

72
00:02:49,760 --> 00:02:51,440
one of the things that we look at very

73
00:02:51,440 --> 00:02:53,920
often when we're looking at a possibly

74
00:02:53,920 --> 00:02:56,879
compromised environment is the the 70-45

75
00:02:56,879 --> 00:02:58,239
message

76
00:02:58,239 --> 00:03:01,280
and this one does not disappoint on the

77
00:03:01,280 --> 00:03:02,840
domain controller

78
00:03:02,840 --> 00:03:05,840
dc.mag tempest.financial

79
00:03:05,840 --> 00:03:07,440
we see powers

80
00:03:07,440 --> 00:03:08,640
ps exec

81
00:03:08,640 --> 00:03:10,959
being run on that machine

82
00:03:10,959 --> 00:03:13,920
via the psx service

83
00:03:13,920 --> 00:03:16,159
and

84
00:03:17,440 --> 00:03:19,760
and furthermore uh

85
00:03:19,760 --> 00:03:22,720
we don't see any additional uh 70 45

86
00:03:22,720 --> 00:03:24,640
messages but but this is uh something

87
00:03:24,640 --> 00:03:26,720
that we'll keep in mind as we

88
00:03:26,720 --> 00:03:29,040
as we look more at the data one of the

89
00:03:29,040 --> 00:03:31,440
things that we do when we analyze a

90
00:03:31,440 --> 00:03:33,920
machine is we look for

91
00:03:33,920 --> 00:03:36,159
for files that look like they're hostile

92
00:03:36,159 --> 00:03:38,799
now actors don't always name their files

93
00:03:38,799 --> 00:03:42,640
obvious this is a hostile file you know

94
00:03:42,640 --> 00:03:44,239
txt but

95
00:03:44,239 --> 00:03:46,480
in this case we did see

96
00:03:46,480 --> 00:03:49,200
uh several files that that

97
00:03:49,200 --> 00:03:51,920
looked like they could be uh created by

98
00:03:51,920 --> 00:03:54,159
the attacker one of them was this

99
00:03:54,159 --> 00:03:58,560
bloodhound zip file on patrice's desktop

100
00:03:58,560 --> 00:04:02,239
we saw several other files indicating

101
00:04:02,239 --> 00:04:05,120
that powersploit had been run and the

102
00:04:05,120 --> 00:04:06,959
invoke port scan

103
00:04:06,959 --> 00:04:10,799
module had been run on the machine

104
00:04:11,040 --> 00:04:13,920
in addition we saw some files that

105
00:04:13,920 --> 00:04:16,399
indicated credential dumping

106
00:04:16,399 --> 00:04:17,440
and

107
00:04:17,440 --> 00:04:20,000
evidence indicates that the first one

108
00:04:20,000 --> 00:04:22,720
was using the task manager

109
00:04:22,720 --> 00:04:25,919
lsas memory dump and the second

110
00:04:25,919 --> 00:04:27,600
using a technique

111
00:04:27,600 --> 00:04:30,880
to use run dll and execute com services

112
00:04:30,880 --> 00:04:33,680
dll to dump

113
00:04:33,680 --> 00:04:35,840
lsas

114
00:04:35,840 --> 00:04:38,240
in addition we find some other very

115
00:04:38,240 --> 00:04:41,280
interesting on the brett social

116
00:04:41,280 --> 00:04:42,560
desktop

117
00:04:42,560 --> 00:04:45,600
four files called computers.txt

118
00:04:45,600 --> 00:04:48,600
one.txt2.txt3.txt

119
00:04:49,440 --> 00:04:51,600
and diving into those files a little

120
00:04:51,600 --> 00:04:52,880
further

121
00:04:52,880 --> 00:04:54,479
we identify that there are a list of ip

122
00:04:54,479 --> 00:04:57,040
addresses now this is important because

123
00:04:57,040 --> 00:04:59,919
when we look at these files as an

124
00:04:59,919 --> 00:05:02,240
investigator now we have

125
00:05:02,240 --> 00:05:03,440
some

126
00:05:03,440 --> 00:05:06,400
evidence to decide the next set of

127
00:05:06,400 --> 00:05:08,800
machines we should look at now those

128
00:05:08,800 --> 00:05:12,320
four files were used by ps exec on the

129
00:05:12,320 --> 00:05:15,610
rdpo1 machine to automate adding

130
00:05:15,610 --> 00:05:17,039
[Music]

131
00:05:17,039 --> 00:05:19,520
uh hostile users to

132
00:05:19,520 --> 00:05:22,720
the local uh local administrators group

133
00:05:22,720 --> 00:05:25,440
right we see the addition of combo

134
00:05:25,440 --> 00:05:26,639
security

135
00:05:26,639 --> 00:05:27,520
uh

136
00:05:27,520 --> 00:05:30,240
a user id called jimbo the user id

137
00:05:30,240 --> 00:05:33,759
called hass and a user id called andy uh

138
00:05:33,759 --> 00:05:36,880
using psx and automating that using

139
00:05:36,880 --> 00:05:39,039
these four files

140
00:05:39,039 --> 00:05:41,840
so diving into some of the evidence the

141
00:05:41,840 --> 00:05:43,360
first place we're looking here is at

142
00:05:43,360 --> 00:05:45,520
patrice's uh

143
00:05:45,520 --> 00:05:48,160
powershell console history and

144
00:05:48,160 --> 00:05:49,440
again we see

145
00:05:49,440 --> 00:05:51,680
that they used uh

146
00:05:51,680 --> 00:05:54,240
the bloodhound

147
00:05:54,240 --> 00:05:55,120
tool

148
00:05:55,120 --> 00:05:56,319
to

149
00:05:56,319 --> 00:05:57,600
scan the environment find

150
00:05:57,600 --> 00:06:01,919
vulnerabilities in active directory

151
00:06:01,919 --> 00:06:03,280
we also see

152
00:06:03,280 --> 00:06:05,520
just as an aside

153
00:06:05,520 --> 00:06:07,600
this lsat stump that we had talked about

154
00:06:07,600 --> 00:06:09,039
earlier

155
00:06:09,039 --> 00:06:10,800
this is coming from

156
00:06:10,800 --> 00:06:13,280
running running chainsaw against the

157
00:06:13,280 --> 00:06:15,919
sysmond operational

158
00:06:15,919 --> 00:06:17,039
event log

159
00:06:17,039 --> 00:06:19,199
and

160
00:06:19,199 --> 00:06:20,400
chainsaw

161
00:06:20,400 --> 00:06:23,600
identified this activity uh

162
00:06:23,600 --> 00:06:27,440
event id 11 as lsas memory dump file

163
00:06:27,440 --> 00:06:28,800
creation

164
00:06:28,800 --> 00:06:31,120
looking further into some of the

165
00:06:31,120 --> 00:06:32,319
evidence

166
00:06:32,319 --> 00:06:33,520
we find

167
00:06:33,520 --> 00:06:34,560
in

168
00:06:34,560 --> 00:06:36,240
uh pat reese's

169
00:06:36,240 --> 00:06:38,400
uh console history powershell console

170
00:06:38,400 --> 00:06:42,880
history uh execution of port scan uh

171
00:06:42,880 --> 00:06:45,120
running against uh

172
00:06:45,120 --> 00:06:47,520
the subnet one seven two one

173
00:06:47,520 --> 00:06:49,599
sixth

174
00:06:49,599 --> 00:06:50,880
looking for

175
00:06:50,880 --> 00:06:53,280
evident uh looking for

176
00:06:53,280 --> 00:06:57,039
port 445 being active

177
00:06:57,280 --> 00:07:00,080
again looking further at this evidence

178
00:07:00,080 --> 00:07:03,440
we see evidence that

179
00:07:03,440 --> 00:07:04,160
the

180
00:07:04,160 --> 00:07:07,759
invoke share finder module was used and

181
00:07:07,759 --> 00:07:10,560
uh looking a little bit further down

182
00:07:10,560 --> 00:07:14,160
at the log we see evidence of

183
00:07:14,160 --> 00:07:17,440
memicats being run in the environment to

184
00:07:17,440 --> 00:07:19,520
uh dump the uh

185
00:07:19,520 --> 00:07:21,759
to dump the hashes

186
00:07:21,759 --> 00:07:23,520
elsas hashes

187
00:07:23,520 --> 00:07:24,960
um

188
00:07:24,960 --> 00:07:28,160
next looking further at again pat

189
00:07:28,160 --> 00:07:29,680
reese's uh

190
00:07:29,680 --> 00:07:31,759
console history in powershell console

191
00:07:31,759 --> 00:07:33,520
history we see

192
00:07:33,520 --> 00:07:35,599
this dump file that we had identified

193
00:07:35,599 --> 00:07:38,560
earlier console history doesn't contain

194
00:07:38,560 --> 00:07:40,800
dates and times in it but

195
00:07:40,800 --> 00:07:43,520
going back to the creation time

196
00:07:43,520 --> 00:07:46,160
that we saw earlier of this dump file we

197
00:07:46,160 --> 00:07:50,000
can get an idea in our timeline of when

198
00:07:50,000 --> 00:07:50,879
this

199
00:07:50,879 --> 00:07:54,000
activity took place

200
00:07:54,479 --> 00:07:57,120
looking further at browser history we

201
00:07:57,120 --> 00:07:59,039
would identify

202
00:07:59,039 --> 00:08:00,720
we collected browser history using

203
00:08:00,720 --> 00:08:03,199
velociraptor and then taking that

204
00:08:03,199 --> 00:08:04,560
browser history

205
00:08:04,560 --> 00:08:07,039
converted it to a csv file and then took

206
00:08:07,039 --> 00:08:08,960
that csv file and put it into a

207
00:08:08,960 --> 00:08:11,280
reporting mechanism

208
00:08:11,280 --> 00:08:15,039
that i use called ach report uh using

209
00:08:15,039 --> 00:08:17,599
this uh and i'll show that in a little

210
00:08:17,599 --> 00:08:18,560
bit

211
00:08:18,560 --> 00:08:22,000
we see that uh this machine reached out

212
00:08:22,000 --> 00:08:23,000
to

213
00:08:23,000 --> 00:08:26,639
file.pizza and transfer.s8

214
00:08:26,639 --> 00:08:29,919
indicating that the actor wanted to take

215
00:08:29,919 --> 00:08:32,399
the data from the machine and x fill it

216
00:08:32,399 --> 00:08:36,000
out we also also see uh it reaching out

217
00:08:36,000 --> 00:08:38,839
to interact.sh now

218
00:08:38,839 --> 00:08:41,200
this one might

219
00:08:41,200 --> 00:08:43,440
say that this could be evidence of

220
00:08:43,440 --> 00:08:46,000
exfiltration interact.sh

221
00:08:46,000 --> 00:08:48,720
is actually an out-of-band detection

222
00:08:48,720 --> 00:08:52,000
mechanism it's used uh when you would

223
00:08:52,000 --> 00:08:56,000
when a hostile actor would execute

224
00:08:56,000 --> 00:08:58,279
an attack and then this

225
00:08:58,279 --> 00:09:01,440
interact.sh is used to report uh on

226
00:09:01,440 --> 00:09:03,839
whether the attack was successful or not

227
00:09:03,839 --> 00:09:05,040
in this case

228
00:09:05,040 --> 00:09:07,440
we don't see the typical

229
00:09:07,440 --> 00:09:10,560
url we would see from interact.sh so the

230
00:09:10,560 --> 00:09:14,000
actor reached out to interact.sh and was

231
00:09:14,000 --> 00:09:16,640
likely just looking at it

232
00:09:16,640 --> 00:09:20,800
probably not being used for

233
00:09:20,839 --> 00:09:24,080
exfil looking further into the evidence

234
00:09:24,080 --> 00:09:28,399
again we see in the sysmon logs uh event

235
00:09:28,399 --> 00:09:30,399
id 13

236
00:09:30,399 --> 00:09:33,920
and power shell i mean uh

237
00:09:33,920 --> 00:09:35,360
chainsaw

238
00:09:35,360 --> 00:09:39,120
identified that this was likely an ntlm

239
00:09:39,120 --> 00:09:41,519
downgrade so this is

240
00:09:41,519 --> 00:09:46,000
at 1909 and at 2054 we saw the actor

241
00:09:46,000 --> 00:09:48,959
uh execute an ntlm downgrade

242
00:09:48,959 --> 00:09:51,279
the idea in an ntlm downgrade is to

243
00:09:51,279 --> 00:09:52,560
force the machine

244
00:09:52,560 --> 00:09:54,000
to allow

245
00:09:54,000 --> 00:09:55,279
insecure

246
00:09:55,279 --> 00:09:56,800
uh

247
00:09:56,800 --> 00:09:57,839
hashing

248
00:09:57,839 --> 00:10:00,399
uh and then those credentials can be

249
00:10:00,399 --> 00:10:02,079
done those hashes can be dumped and

250
00:10:02,079 --> 00:10:04,800
they're easier to crack offline

251
00:10:04,800 --> 00:10:08,720
so we see evidence and of that activity

252
00:10:08,720 --> 00:10:10,880
and if we wanted to we could actually

253
00:10:10,880 --> 00:10:14,160
look in the user's

254
00:10:15,360 --> 00:10:16,640
registry

255
00:10:16,640 --> 00:10:18,240
actually not in the user's registry in

256
00:10:18,240 --> 00:10:21,360
the machine registry hq local machine

257
00:10:21,360 --> 00:10:22,880
and we would find

258
00:10:22,880 --> 00:10:26,320
the evidence uh in lm compatibility

259
00:10:26,320 --> 00:10:30,160
level uh ntlm min client sec

260
00:10:30,160 --> 00:10:34,320
and uh restrict sending ntlm traffic we

261
00:10:34,320 --> 00:10:35,440
would find

262
00:10:35,440 --> 00:10:37,120
evidence in those keys

263
00:10:37,120 --> 00:10:38,480
uh that

264
00:10:38,480 --> 00:10:39,600
the

265
00:10:39,600 --> 00:10:40,720
uh

266
00:10:40,720 --> 00:10:43,279
nt that ntlm had been

267
00:10:43,279 --> 00:10:47,360
set to to allow downgrading looking

268
00:10:47,360 --> 00:10:51,920
at this activity in uh chainsaw we also

269
00:10:51,920 --> 00:10:54,880
see further evidence of power shell

270
00:10:54,880 --> 00:10:57,519
being executed in the environment of

271
00:10:57,519 --> 00:10:59,120
kind of just an added thing we were

272
00:10:59,120 --> 00:11:00,800
really looking

273
00:11:00,800 --> 00:11:03,600
at the ntlm downgrade but this is what

274
00:11:03,600 --> 00:11:05,680
you'll find often when looking at

275
00:11:05,680 --> 00:11:08,560
evidence is other pieces will pop out

276
00:11:08,560 --> 00:11:10,480
you'll take note of them and then add

277
00:11:10,480 --> 00:11:13,440
them into your timeline

278
00:11:13,440 --> 00:11:16,720
here we're seeing uh evidence of ps exec

279
00:11:16,720 --> 00:11:19,839
now this is important because what we

280
00:11:19,839 --> 00:11:23,120
see here is the two machines

281
00:11:23,120 --> 00:11:26,320
that are being attacked right we see

282
00:11:26,320 --> 00:11:30,720
dco2 and rdpo1 so we see rdpo1

283
00:11:30,720 --> 00:11:33,440
authenticating to dc02

284
00:11:33,440 --> 00:11:35,519
and then we see

285
00:11:35,519 --> 00:11:37,600
dco2 running

286
00:11:37,600 --> 00:11:39,680
ps exec running the service that allows

287
00:11:39,680 --> 00:11:41,440
ps exec

288
00:11:41,440 --> 00:11:43,600
and you'll notice that all of the time

289
00:11:43,600 --> 00:11:46,320
stamps are 8.59 so this is a strong

290
00:11:46,320 --> 00:11:49,200
correlation that rdpo1

291
00:11:49,200 --> 00:11:50,079
uh

292
00:11:50,079 --> 00:11:54,000
authenticated to dc02 and ran powershell

293
00:11:54,000 --> 00:11:56,720
i'm i keep saying powershell ran ps

294
00:11:56,720 --> 00:12:00,800
exact uh on that machine

295
00:12:01,279 --> 00:12:04,160
uh again we mentioned earlier

296
00:12:04,160 --> 00:12:04,959
that

297
00:12:04,959 --> 00:12:06,639
uh these

298
00:12:06,639 --> 00:12:10,160
files found on the desktop this desktop

299
00:12:10,160 --> 00:12:12,240
computers.txt

300
00:12:12,240 --> 00:12:13,720
1.txt

301
00:12:13,720 --> 00:12:17,600
2.txt and 3.txt were

302
00:12:17,600 --> 00:12:19,839
used to automate powershell

303
00:12:19,839 --> 00:12:21,360
to

304
00:12:21,360 --> 00:12:23,440
add

305
00:12:23,440 --> 00:12:25,120
hostile actors to the administrative

306
00:12:25,120 --> 00:12:27,120
hostile user ids to the administrators

307
00:12:27,120 --> 00:12:30,480
group and here we see that evidence in

308
00:12:30,480 --> 00:12:32,560
the sysmod logs

309
00:12:32,560 --> 00:12:35,519
again extracted using

310
00:12:35,519 --> 00:12:39,920
chainsaw and formatted using ach report

311
00:12:39,920 --> 00:12:42,240
so these are

312
00:12:42,240 --> 00:12:45,040
event id one that

313
00:12:45,040 --> 00:12:47,760
we saw chainsaw identify

314
00:12:47,760 --> 00:12:49,519
as

315
00:12:49,519 --> 00:12:51,279
hurricane panda but

316
00:12:51,279 --> 00:12:53,760
really what we're looking at here is

317
00:12:53,760 --> 00:12:57,040
powershell being used to automate

318
00:12:57,040 --> 00:12:59,519
adding

319
00:12:59,839 --> 00:13:02,160
hostile administrators to

320
00:13:02,160 --> 00:13:04,800
several machines that are located in

321
00:13:04,800 --> 00:13:07,920
those txt files ip addresses located in

322
00:13:07,920 --> 00:13:09,680
those txt files

323
00:13:09,680 --> 00:13:12,959
uh on the machines themselves here we're

324
00:13:12,959 --> 00:13:14,959
seeing on

325
00:13:14,959 --> 00:13:16,240
dc

326
00:13:16,240 --> 00:13:19,440
the commands being executed

327
00:13:19,440 --> 00:13:20,639
and

328
00:13:20,639 --> 00:13:23,440
we see combo security being added with a

329
00:13:23,440 --> 00:13:27,120
password of b4by metal

330
00:13:27,120 --> 00:13:30,560
an important piece of information

331
00:13:30,560 --> 00:13:33,360
because now we can go to that machine

332
00:13:33,360 --> 00:13:35,440
and we know both the

333
00:13:35,440 --> 00:13:37,680
hostile user that was added and its

334
00:13:37,680 --> 00:13:40,399
password uh we also see

335
00:13:40,399 --> 00:13:42,399
here later on

336
00:13:42,399 --> 00:13:44,560
in this log evidence

337
00:13:44,560 --> 00:13:47,440
that the event log

338
00:13:47,440 --> 00:13:48,399
uh

339
00:13:48,399 --> 00:13:50,720
the event logs were cleared application

340
00:13:50,720 --> 00:13:54,079
security and system

341
00:13:54,399 --> 00:13:57,519
another piece of added information

342
00:13:57,519 --> 00:13:59,040
that we can add to what we know about

343
00:13:59,040 --> 00:14:02,320
this machine is we saw we see now pat

344
00:14:02,320 --> 00:14:05,760
reese's in his console history that uh

345
00:14:05,760 --> 00:14:08,880
mimikatz was run invoke mimikatz from

346
00:14:08,880 --> 00:14:10,480
powershell empire

347
00:14:10,480 --> 00:14:12,720
uh and these

348
00:14:12,720 --> 00:14:15,040
hashes were used uh you'll see the hash

349
00:14:15,040 --> 00:14:16,480
being used

350
00:14:16,480 --> 00:14:18,320
to escalate

351
00:14:18,320 --> 00:14:20,160
this machine to

352
00:14:20,160 --> 00:14:23,040
administrator

353
00:14:25,680 --> 00:14:28,399
as mentioned earlier

354
00:14:28,399 --> 00:14:32,480
we see now uh using chainsaw

355
00:14:32,480 --> 00:14:34,399
chainsaw identified

356
00:14:34,399 --> 00:14:37,600
that the event logs had been cleared uh

357
00:14:37,600 --> 00:14:39,519
this would be an important time in our

358
00:14:39,519 --> 00:14:41,600
timeline because it would

359
00:14:41,600 --> 00:14:43,360
define

360
00:14:43,360 --> 00:14:45,920
the point in time where we can really

361
00:14:45,920 --> 00:14:47,519
uh we really

362
00:14:47,519 --> 00:14:48,800
won't know

363
00:14:48,800 --> 00:14:49,760
uh

364
00:14:49,760 --> 00:14:52,000
about what happened so

365
00:14:52,000 --> 00:14:54,079
once the event logs were cleared

366
00:14:54,079 --> 00:14:56,079
um

367
00:14:56,079 --> 00:14:58,160
data previous to this would not be

368
00:14:58,160 --> 00:15:00,399
available to us in the event log so we

369
00:15:00,399 --> 00:15:02,079
would have to look to other

370
00:15:02,079 --> 00:15:04,880
pieces of evidence to identify

371
00:15:04,880 --> 00:15:07,920
activity on this machine

372
00:15:09,279 --> 00:15:10,320
okay

373
00:15:10,320 --> 00:15:12,800
that was a real quick run through

374
00:15:12,800 --> 00:15:13,760
of

375
00:15:13,760 --> 00:15:16,160
you know the evidence that we looked at

376
00:15:16,160 --> 00:15:17,680
uh actually

377
00:15:17,680 --> 00:15:21,519
um not a lot of pieces uh

378
00:15:21,519 --> 00:15:24,320
are not a lot of artifacts but a lot of

379
00:15:24,320 --> 00:15:26,880
information being gathered so

380
00:15:26,880 --> 00:15:28,880
let's take a look at some of that data

381
00:15:28,880 --> 00:15:31,680
in its in its native form or in the form

382
00:15:31,680 --> 00:15:33,600
that you know we

383
00:15:33,600 --> 00:15:36,399
we would review as we gathered

384
00:15:36,399 --> 00:15:40,160
information about this machine

385
00:15:40,160 --> 00:15:43,120
first on the dc system uh i mentioned

386
00:15:43,120 --> 00:15:45,680
that we were looking at the 7045

387
00:15:45,680 --> 00:15:48,560
messages so here we're looking at

388
00:15:48,560 --> 00:15:50,160
uh the system

389
00:15:50,160 --> 00:15:51,920
event log

390
00:15:51,920 --> 00:15:52,839
in this

391
00:15:52,839 --> 00:15:55,680
case probably the best way

392
00:15:55,680 --> 00:15:57,600
to look at this data would be to filter

393
00:15:57,600 --> 00:15:59,120
the log

394
00:15:59,120 --> 00:16:02,480
looking for 7045

395
00:16:02,800 --> 00:16:04,480
and sure enough

396
00:16:04,480 --> 00:16:06,560
as we mentioned in our our

397
00:16:06,560 --> 00:16:09,199
walk through earlier we see

398
00:16:09,199 --> 00:16:10,959
the evidence of

399
00:16:10,959 --> 00:16:12,240
powershell

400
00:16:12,240 --> 00:16:13,680
the power shell

401
00:16:13,680 --> 00:16:15,120
service piece

402
00:16:15,120 --> 00:16:17,839
being run on the on the domain

403
00:16:17,839 --> 00:16:19,759
controller

404
00:16:19,759 --> 00:16:21,360
we also mentioned

405
00:16:21,360 --> 00:16:24,560
on rdp01

406
00:16:24,560 --> 00:16:26,880
let's see we're looking at dc here

407
00:16:26,880 --> 00:16:29,040
rdpo1 this is the

408
00:16:29,040 --> 00:16:33,120
the the report tool that i use um

409
00:16:33,120 --> 00:16:35,519
this report tool does not

410
00:16:35,519 --> 00:16:37,839
do a lot of the

411
00:16:37,839 --> 00:16:39,360
uh

412
00:16:39,360 --> 00:16:41,279
of the parsing of the data it does some

413
00:16:41,279 --> 00:16:44,000
parsing but mostly it's used to put all

414
00:16:44,000 --> 00:16:46,880
of the data to run the parsing utilities

415
00:16:46,880 --> 00:16:49,759
uh and put them all in one place so what

416
00:16:49,759 --> 00:16:53,040
we're going to look at is we identified

417
00:16:53,040 --> 00:16:54,800
that bloodhound was running the

418
00:16:54,800 --> 00:16:57,279
environment

419
00:17:00,639 --> 00:17:02,480
and here we see

420
00:17:02,480 --> 00:17:03,600
that

421
00:17:03,600 --> 00:17:05,679
velociraptor

422
00:17:05,679 --> 00:17:07,520
collected the

423
00:17:07,520 --> 00:17:09,359
console history powershell console

424
00:17:09,359 --> 00:17:13,039
history of patrice's and

425
00:17:13,039 --> 00:17:16,240
this reporting tool simply shows

426
00:17:16,240 --> 00:17:17,359
the

427
00:17:17,359 --> 00:17:18,559
the activity

428
00:17:18,559 --> 00:17:20,640
uh that that was

429
00:17:20,640 --> 00:17:22,720
uh

430
00:17:22,720 --> 00:17:23,919
that was

431
00:17:23,919 --> 00:17:26,880
in that console history and here we see

432
00:17:26,880 --> 00:17:30,559
the execution of uh a bloodhound and

433
00:17:30,559 --> 00:17:31,679
then

434
00:17:31,679 --> 00:17:34,480
the file name that it was saved under

435
00:17:34,480 --> 00:17:35,440
and

436
00:17:35,440 --> 00:17:38,720
this gives us uh information on if we

437
00:17:38,720 --> 00:17:40,559
look at that file

438
00:17:40,559 --> 00:17:41,520
when

439
00:17:41,520 --> 00:17:43,440
that was run now that's not an

440
00:17:43,440 --> 00:17:46,400
indication of the first time it was run

441
00:17:46,400 --> 00:17:49,200
it was it's really an indication of of

442
00:17:49,200 --> 00:17:51,679
what is available to us so bloodhound

443
00:17:51,679 --> 00:17:53,520
could have been run five times four

444
00:17:53,520 --> 00:17:55,840
times it could have been run once uh but

445
00:17:55,840 --> 00:17:58,320
what we have in this evidence is that

446
00:17:58,320 --> 00:18:01,600
bloodhound was run and that it was run

447
00:18:01,600 --> 00:18:03,760
at a specific time

448
00:18:03,760 --> 00:18:06,559
we also identified

449
00:18:06,559 --> 00:18:09,039
that a port scan was run

450
00:18:09,039 --> 00:18:10,080
so

451
00:18:10,080 --> 00:18:12,480
again looking in

452
00:18:12,480 --> 00:18:13,360
this

453
00:18:13,360 --> 00:18:16,240
console history we identify

454
00:18:16,240 --> 00:18:18,240
that uh the port that

455
00:18:18,240 --> 00:18:19,760
port scan was run

456
00:18:19,760 --> 00:18:22,720
from uh

457
00:18:22,720 --> 00:18:25,520
from power supply

458
00:18:27,200 --> 00:18:28,720
one of the things we previously

459
00:18:28,720 --> 00:18:31,280
identified

460
00:18:31,280 --> 00:18:32,320
was

461
00:18:32,320 --> 00:18:34,000
the dump file

462
00:18:34,000 --> 00:18:36,880
uh created by

463
00:18:36,880 --> 00:18:39,760
running com running com services dll

464
00:18:39,760 --> 00:18:43,360
through the through run dll uh creating

465
00:18:43,360 --> 00:18:46,000
this dump file which would be a dump of

466
00:18:46,000 --> 00:18:47,360
lsas

467
00:18:47,360 --> 00:18:49,600
now if we look at

468
00:18:49,600 --> 00:18:53,280
that uh search for c column backslash

469
00:18:53,280 --> 00:18:57,120
dump we also find here is when that was

470
00:18:57,120 --> 00:19:00,400
run so looking at rdp01

471
00:19:00,400 --> 00:19:01,679
we see

472
00:19:01,679 --> 00:19:04,400
uh that don't file being created

473
00:19:04,400 --> 00:19:05,280
and

474
00:19:05,280 --> 00:19:06,080
uh

475
00:19:06,080 --> 00:19:07,520
in the

476
00:19:07,520 --> 00:19:08,880
uh

477
00:19:08,880 --> 00:19:12,240
in the uh

478
00:19:12,960 --> 00:19:14,720
cismond

479
00:19:14,720 --> 00:19:17,039
event log um

480
00:19:17,039 --> 00:19:19,440
chainsaw identified

481
00:19:19,440 --> 00:19:22,559
this activity and uh reported it and we

482
00:19:22,559 --> 00:19:24,000
just we just take that and put it into

483
00:19:24,000 --> 00:19:26,080
this reporting format

484
00:19:26,080 --> 00:19:29,840
another thing that we saw earlier

485
00:19:30,720 --> 00:19:32,240
was

486
00:19:32,240 --> 00:19:34,240
evidence of

487
00:19:34,240 --> 00:19:37,600
at least attempts to exfiltrate data

488
00:19:37,600 --> 00:19:40,640
so looking at the activity around that

489
00:19:40,640 --> 00:19:41,760
time

490
00:19:41,760 --> 00:19:43,840
we see

491
00:19:43,840 --> 00:19:46,440
the actor reaching out to file pizza

492
00:19:46,440 --> 00:19:49,600
transfer.sh and if we look a little bit

493
00:19:49,600 --> 00:19:51,600
further down we also see

494
00:19:51,600 --> 00:19:53,440
the actor

495
00:19:53,440 --> 00:19:57,120
reaching out to webb wormhole dot io

496
00:19:57,120 --> 00:19:59,200
these are all

497
00:19:59,200 --> 00:20:00,960
evidence that

498
00:20:00,960 --> 00:20:02,640
the actor

499
00:20:02,640 --> 00:20:04,320
was at least

500
00:20:04,320 --> 00:20:07,360
interested in exfiltrating the data out

501
00:20:07,360 --> 00:20:10,080
of the environment

502
00:20:10,080 --> 00:20:12,960
one of the other things we saw

503
00:20:12,960 --> 00:20:15,360
we mentioned earlier was an ntlm

504
00:20:15,360 --> 00:20:18,240
downgrade attack

505
00:20:18,320 --> 00:20:23,280
so here looking at the chainsaw output

506
00:20:23,280 --> 00:20:28,320
we see what we had seen earlier which is

507
00:20:28,320 --> 00:20:29,679
the ntlm

508
00:20:29,679 --> 00:20:33,039
chainsaw identified this as ntlm

509
00:20:33,039 --> 00:20:35,919
net ntlm downgrade and

510
00:20:35,919 --> 00:20:38,799
again we could go to the registry itself

511
00:20:38,799 --> 00:20:40,640
if we wanted to have some corroborating

512
00:20:40,640 --> 00:20:43,360
evidence we could go to the registry

513
00:20:43,360 --> 00:20:44,320
itself

514
00:20:44,320 --> 00:20:45,919
and

515
00:20:45,919 --> 00:20:48,960
show that those register keys had indeed

516
00:20:48,960 --> 00:20:51,280
been modified

517
00:20:51,280 --> 00:20:53,600
uh furthermore on

518
00:20:53,600 --> 00:20:56,080
dc02

519
00:20:56,080 --> 00:20:59,120
uh we also identified that

520
00:20:59,120 --> 00:21:00,960
powershell

521
00:21:00,960 --> 00:21:04,240
that powershell the ps exec had been run

522
00:21:04,240 --> 00:21:06,000
on that machine also

523
00:21:06,000 --> 00:21:08,159
we see that in

524
00:21:08,159 --> 00:21:09,120
a

525
00:21:09,120 --> 00:21:12,639
event id of 11.

526
00:21:14,240 --> 00:21:18,000
so let's look for event id11

527
00:21:18,000 --> 00:21:20,880
and we saw that activity at about

528
00:21:20,880 --> 00:21:23,440
at 2059. so

529
00:21:23,440 --> 00:21:28,039
as we look through this data

530
00:21:34,559 --> 00:21:38,120
go down to 2059.

531
00:21:54,640 --> 00:21:56,640
and we see

532
00:21:56,640 --> 00:21:58,400
the evidence that

533
00:21:58,400 --> 00:22:01,120
ps exec had been run on this machine

534
00:22:01,120 --> 00:22:04,760
at uh 2059-57

535
00:22:06,960 --> 00:22:09,200
all right

536
00:22:09,200 --> 00:22:11,919
so looking further at our reporting tool

537
00:22:11,919 --> 00:22:12,880
um

538
00:22:12,880 --> 00:22:14,080
we see

539
00:22:14,080 --> 00:22:17,399
on rdp01

540
00:22:23,679 --> 00:22:27,120
this evidence on rdp01

541
00:22:27,120 --> 00:22:28,960
that

542
00:22:28,960 --> 00:22:31,360
ps exec and again this is you know just

543
00:22:31,360 --> 00:22:33,039
what we had seen

544
00:22:33,039 --> 00:22:34,799
uh in the

545
00:22:34,799 --> 00:22:37,600
screenshot but here we're looking at the

546
00:22:37,600 --> 00:22:40,080
evidence itself

547
00:22:40,080 --> 00:22:42,480
event id 1

548
00:22:42,480 --> 00:22:45,360
identified by chainsaw as powershell

549
00:22:45,360 --> 00:22:48,000
exec automating the addition

550
00:22:48,000 --> 00:22:49,280
of

551
00:22:49,280 --> 00:22:50,880
combo security

552
00:22:50,880 --> 00:22:52,000
to

553
00:22:52,000 --> 00:22:55,360
the administrators group on that set of

554
00:22:55,360 --> 00:22:58,240
ip addresses in the computer.txt

555
00:22:58,240 --> 00:23:01,240
1.txt2.txtn3.txt

556
00:23:01,919 --> 00:23:03,280
files

557
00:23:03,280 --> 00:23:06,000
as we look at this data we could then

558
00:23:06,000 --> 00:23:09,360
look around it uh and see that

559
00:23:09,360 --> 00:23:12,000
the actor had also done

560
00:23:12,000 --> 00:23:15,200
some uh discovery of the environment

561
00:23:15,200 --> 00:23:17,840
running who am i

562
00:23:17,840 --> 00:23:18,880
and

563
00:23:18,880 --> 00:23:21,360
other activity

564
00:23:21,360 --> 00:23:25,440
again we see the the dump of lsas so uh

565
00:23:25,440 --> 00:23:28,640
looking at this data in context uh we

566
00:23:28,640 --> 00:23:30,960
can identify the times that this

567
00:23:30,960 --> 00:23:33,600
activity happened and we get a better

568
00:23:33,600 --> 00:23:36,880
idea of sort of what the actor was doing

569
00:23:36,880 --> 00:23:38,559
on this machine

570
00:23:38,559 --> 00:23:40,159
and that can help us draw conclusions

571
00:23:40,159 --> 00:23:42,559
about what the actor was after what they

572
00:23:42,559 --> 00:23:45,120
were interested in uh and

573
00:23:45,120 --> 00:23:48,880
uh what they uh accomplished or and

574
00:23:48,880 --> 00:23:50,720
sometimes what they didn't accomplish

575
00:23:50,720 --> 00:23:53,279
so uh looking at

576
00:23:53,279 --> 00:23:55,919
uh the domain controller

577
00:23:55,919 --> 00:23:58,720
right we'll see the

578
00:23:58,720 --> 00:24:01,039
evidence that

579
00:24:01,039 --> 00:24:02,240
that

580
00:24:02,240 --> 00:24:04,240
activity was successful on the domain

581
00:24:04,240 --> 00:24:06,880
controller so let's do a find

582
00:24:06,880 --> 00:24:09,600
and let's look for cable security and

583
00:24:09,600 --> 00:24:10,880
here we see

584
00:24:10,880 --> 00:24:12,400
that uh

585
00:24:12,400 --> 00:24:14,559
on the actual machine

586
00:24:14,559 --> 00:24:18,080
that net user combo security was run and

587
00:24:18,080 --> 00:24:20,640
and again uh we're able to draw some

588
00:24:20,640 --> 00:24:22,159
context around

589
00:24:22,159 --> 00:24:25,039
around times and activity

590
00:24:25,039 --> 00:24:27,919
on this machine

591
00:24:28,400 --> 00:24:32,760
moving back to rdp01

592
00:24:39,360 --> 00:24:42,240
we also saw

593
00:24:44,720 --> 00:24:47,440
the pass the hash escalation or

594
00:24:47,440 --> 00:24:51,600
elevation activity um and again

595
00:24:51,600 --> 00:24:53,360
looking at

596
00:24:53,360 --> 00:24:55,039
pat reese's

597
00:24:55,039 --> 00:24:56,559
console history powershell console

598
00:24:56,559 --> 00:24:58,880
history we don't have times

599
00:24:58,880 --> 00:25:00,880
but we do have

600
00:25:00,880 --> 00:25:03,440
a good picture of

601
00:25:03,440 --> 00:25:05,760
what the actor did

602
00:25:05,760 --> 00:25:09,039
uh using powershell not entirely not all

603
00:25:09,039 --> 00:25:10,960
the things the actor did but but the

604
00:25:10,960 --> 00:25:14,240
activity that the actor

605
00:25:14,240 --> 00:25:16,799
did on this machine uh when using

606
00:25:16,799 --> 00:25:18,960
powershell

607
00:25:18,960 --> 00:25:20,720
uh the other the last thing we're going

608
00:25:20,720 --> 00:25:22,799
to look at of course

609
00:25:22,799 --> 00:25:25,760
is this evidence

610
00:25:25,760 --> 00:25:28,559
that um

611
00:25:28,559 --> 00:25:31,039
the actor cleared

612
00:25:31,039 --> 00:25:32,480
the event logs

613
00:25:32,480 --> 00:25:34,080
we can see

614
00:25:34,080 --> 00:25:35,440
not only

615
00:25:35,440 --> 00:25:36,240
the

616
00:25:36,240 --> 00:25:39,919
execution of that

617
00:25:40,960 --> 00:25:41,080
uh command

618
00:25:44,080 --> 00:25:46,320
that the event logs were cleared but we

619
00:25:46,320 --> 00:25:49,120
cannot get an idea of exactly when that

620
00:25:49,120 --> 00:25:50,640
happened

621
00:25:50,640 --> 00:25:52,880
right by looking at

622
00:25:52,880 --> 00:25:55,520
what is left in the event logs uh after

623
00:25:55,520 --> 00:25:58,080
they're cleared

624
00:26:06,960 --> 00:26:08,400
okay so

625
00:26:08,400 --> 00:26:10,480
recapping

626
00:26:10,480 --> 00:26:15,039
what we did on this machine to

627
00:26:15,039 --> 00:26:18,559
analyze it and to draw some conclusions

628
00:26:18,559 --> 00:26:20,320
we had

629
00:26:20,320 --> 00:26:22,880
an environment that was compromised

630
00:26:22,880 --> 00:26:25,039
we ran velociraptor

631
00:26:25,039 --> 00:26:27,679
on the machine to gather

632
00:26:27,679 --> 00:26:30,159
telemetry and artifacts

633
00:26:30,159 --> 00:26:32,480
sysmon was running on the machine so we

634
00:26:32,480 --> 00:26:33,679
used that

635
00:26:33,679 --> 00:26:35,919
as the basis for

636
00:26:35,919 --> 00:26:37,360
a lot of our

637
00:26:37,360 --> 00:26:40,080
conclusions we ran chainsaw

638
00:26:40,080 --> 00:26:41,840
on the machine

639
00:26:41,840 --> 00:26:44,799
to look at the event logs

640
00:26:44,799 --> 00:26:46,240
and

641
00:26:46,240 --> 00:26:47,440
identify

642
00:26:47,440 --> 00:26:50,720
hostile activity chainsaw uses

643
00:26:50,720 --> 00:26:54,080
sigma rules to identify

644
00:26:54,080 --> 00:26:57,120
hostile activity we took that data and

645
00:26:57,120 --> 00:26:59,919
we put it in a reporting to tool ach

646
00:26:59,919 --> 00:27:02,320
report to put all the data in one place

647
00:27:02,320 --> 00:27:04,480
to make it easier to kind of

648
00:27:04,480 --> 00:27:07,039
draw context around

649
00:27:07,039 --> 00:27:09,120
times and activities

650
00:27:09,120 --> 00:27:12,480
and we also use a tool called mft dump

651
00:27:12,480 --> 00:27:13,520
which

652
00:27:13,520 --> 00:27:14,799
takes the

653
00:27:14,799 --> 00:27:16,480
mft

654
00:27:16,480 --> 00:27:19,039
which velociraptor collected turns that

655
00:27:19,039 --> 00:27:21,919
into a comma separated values file a csv

656
00:27:21,919 --> 00:27:25,520
file and then ach report can ask

657
00:27:25,520 --> 00:27:26,880
that

658
00:27:26,880 --> 00:27:30,240
file questions about

659
00:27:30,240 --> 00:27:33,120
files that are identified

660
00:27:33,120 --> 00:27:36,159
on that machine and this is where we get

661
00:27:36,159 --> 00:27:38,880
we got some timestamps of when those

662
00:27:38,880 --> 00:27:42,240
hostile files were created and

663
00:27:42,240 --> 00:27:44,000
how they were created what tools were

664
00:27:44,000 --> 00:27:47,799
used to create them

665
00:27:48,559 --> 00:27:52,640
that concludes uh our walkthrough of

666
00:27:52,640 --> 00:27:54,960
kill chain three uh

667
00:27:54,960 --> 00:27:58,159
to learn further about project obsidian

668
00:27:58,159 --> 00:28:01,200
about blue team village uh please join

669
00:28:01,200 --> 00:28:03,840
us on our discord channel join the

670
00:28:03,840 --> 00:28:06,720
conversation uh we'll be releasing all

671
00:28:06,720 --> 00:28:09,520
of this data as open source we'll be

672
00:28:09,520 --> 00:28:11,840
providing it to the community for

673
00:28:11,840 --> 00:28:13,760
lots of reasons um

674
00:28:13,760 --> 00:28:16,320
one is so that you can walk through the

675
00:28:16,320 --> 00:28:18,240
data using your own tools or or the

676
00:28:18,240 --> 00:28:22,399
tools we used um to learn more uh and to

677
00:28:22,399 --> 00:28:24,960
gain some hands-on experience of you

678
00:28:24,960 --> 00:28:27,360
know how your workflow

679
00:28:27,360 --> 00:28:30,799
would uh would would go when you're

680
00:28:30,799 --> 00:28:32,320
analyzing data you're learning to

681
00:28:32,320 --> 00:28:33,840
analyze data

682
00:28:33,840 --> 00:28:36,320
the second thing is that we hope that

683
00:28:36,320 --> 00:28:40,000
this will be used by people with with

684
00:28:40,000 --> 00:28:43,279
uh new tools so as new tools come out

685
00:28:43,279 --> 00:28:45,840
new blue team tools are always come out

686
00:28:45,840 --> 00:28:46,960
coming out

687
00:28:46,960 --> 00:28:50,399
this data can be used to

688
00:28:50,399 --> 00:28:52,559
test those tools to see if

689
00:28:52,559 --> 00:28:54,720
the same conclusions are drawn or if

690
00:28:54,720 --> 00:28:57,120
those tools find other information that

691
00:28:57,120 --> 00:28:59,919
we may not have uncovered

692
00:28:59,919 --> 00:29:01,200
and also

693
00:29:01,200 --> 00:29:03,679
you can join the conversation

694
00:29:03,679 --> 00:29:04,480
on

695
00:29:04,480 --> 00:29:07,440
twitter we're at blue team village or if

696
00:29:07,440 --> 00:29:09,200
you want to learn more about the blue

697
00:29:09,200 --> 00:29:10,880
team village

698
00:29:10,880 --> 00:29:13,200
you can go to our website

699
00:29:13,200 --> 00:29:16,200
blueteamvillage.org