APT33 Group Technique
|
Detection Technique
|
Python-based backdoor
|
Look for Python making external network connections
|
At.exe used to perform task scheduling
|
Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.
Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. Several events will then be logged on scheduled task activity, including:
Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled
|
Specific files created by APT33 backdoor
|
Look for the presence of the following files: SmartMega.exe, DysonPart.exe, MsdUpdate.exe in the Application Data folder (%LOCALAPPDATA% or %APPDATA%)
|
Dumps stored credentials from lsass.exe
|
Sysmon can be used, look for EventCode 10, where the TargetImage is lsass.exe and GrantedAccess is 0x1010. Sample Splunk query: EventCode=10 | where (GrantedAccess="0x1010" AND TargetImage LIKE "%lsass.exe")
|
Uses run keys for persistence
|
Analyze the following registry keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
|
Mimikatz used to dump credentials from lsass.exe
|
First look for EventCode of 1 where ParentImage is cmd.exe and IntegrityLevel is high. Followed by EventCode of 10 where GrantedAccess is 0x1010 and TargetImage is lsass.exe and SourceImage is not svchost.exe
SEQUENCE:
1. EventCode=1 | where (match(ParentImage, "cmd.exe") AND match(IntegrityLevel, "high"))
2. EventCode=10 | where (match(GrantedAccess, "0x1010") AND !match(SourceImage, "svchost\.exe") AND match(TargetImage, "lsass\.exe"))
|
Malware uses IP addresses directly with no domains in URLs
|
Analyze network traffic looking for this behavior (hxxp://1.2.3.4/api/info)
|
Malware runs PowerShell with suspect arguments
|
Search for PowerShell command line execution containing suspect arguments (-nop -enc -bypass etc)
|
Malware executes Powershell from non-standard locations
|
Search for Powershell running from unusual locations (e.g. directories under %LOCALAPPDATA%)
Normal locations:
32-bit (x86) PowerShell executable %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
64-bit (x64) Powershell executable %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
32-bit (x86) Powershell ISE executable %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
64-bit (x64) Powershell ISE executable %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell_ise.exe
32-bit (x86) PowerShell executable %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
32-bit (x86) Powershell ISE executable %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell_ise.exe
|
Suspect PowerShell cmdlets
|
Looks for suspect cmdlets that are often used for only malicious purposes
|
Malware uses Outlook to download additional files
|
Search for Outlook.exe directly requesting externally hosted files
|
Remcos installs to a specific location during install and deletes itself
|
Look for the following file being created or deleted: %AppData%\remcos\remcos.exe
|
Windows task scheduler used to schedule malicious code to run
|
Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.
Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. Several events will then be logged on scheduled task activity, including:
Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered
Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated
Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted
Event ID 4698 on Windows 10, Server 2016 - Scheduled task created
Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled
Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled
|
Delivers obfuscated JavaScript from compromised websites
|
Analyze all JavaScript being executed for obfuscation techniques and for code pointing to a different domain
|
Office Macros launch command line/scripting processes
|
Look for strange children of Microsoft Office processes (winword.exe, excel.exe, powerpnt.exe, msaccess.exe, outlook.exe, visio.exe, winproj.exe, etc) such as, but not limited to:
cmd.exe
powershell.exe
cscript.exe
wscript.exe
Microsoft Office 2013 paths:
C:\Program Files\Microsoft Office\Office15\
C:\Program Files (x86)\Microsoft Office\Office15\
C:\Program Files\Microsoft Office 15\ClientX64\Root\Office15\
C:\Program Files (x86)\Microsoft Office 15\ClientX86\Root\Office15\
Microsoft Office 2016 paths:
C:\Program Files\Microsoft Office\Office16\
C:\Program Files (x86)\Microsoft Office\Office16\
C:\Program Files\Microsoft Office 16\ClientX64\Root\Office16\
C:\Program Files (x86)\Microsoft Office 16\ClientX86\Root\Office16\
|
Mimikatz unique strings
|
Look in Powershell logs for the following strings which are unique to Mimikatz:
privilege::debug
sekurlsa::logonpasswords
|
Adversary uses domain masquerading to blend in
|
Analyze network traffic looking for domains that look similar to internal or trusted partner (e.g. example.com and example.com.sg)
|
Process hollowing used to evade detection
|
Investigate the user of the following API calls which are used to unmap process memory: ZwUnmapViewOfSection or NtUnmapViewOfSection. Also, WriteProcessMemory, which can be used to modify memory in another process
|
Remcos creates a mutex to mark that it is installed on a system
|
Look for the mutex remcos_etrcewrortwiujm present on a system
|
WMI is used for persistence
|
Verify all WmiEventFilter, WmiEventconsumer and WmiEventConsumerToFilter activity.
|
Dumps stored credentials from lsass.exe
|
Use Windows event logs to determine a handle for lsass.exe being requested via either Event Codes 4656 or 4663, where Object_name contains lsass.exe and Access_Mask is 0x143A. Sample Splunk queries:
EventCode=4656 OR EventCode=4663 | eval HandleReq=case(EventCode=4656 AND Object_Name LIKE "%lsass.exe" AND Access_Mask=="0x143A", Process_ID) | where (HandleReq=Process_ID)
EventCode=4656 | where (Object_Name LIKE "%lsass.exe" AND Access_Mask=="0x143A")
|
Specific URL path used by APT33 backdoor
|
Look in network logs for activity matching the following pattern: /update.php?c=[0-9a-fA-F]{32}
|
Actors include malicious links in spear phishing emails
|
Examine incoming emails looking for links to .hta files
|
Malware runs PowerShell with suspect parents
|
Search for PowerShell with questionable parent processes such as:
explorer.exe
cmd.exe
winword.exe
excel.exe
powerpnt.exe
outlook.exe
|
Password spray is used, trying a small set of passwords on a large amount of users
|
Analyze failed login attempts for where a source has a large volume of different users
|
Look for common name of Mimikatz cmdlet
|
Look in Powershell logs for "Invoke-Mimikatz" which is the common name for the Mimikatz cmdlet
|
Outlook client homepages are created for execution and persistence
|
Analyze the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Office\<Outlook Version>\ Outlook\WebView\Inbox
“URL”= http://badsite/homepage-persist.html
|
Powershell used to dump credentials from lsass.exe
|
Use Windows event logs to determine a handle for lsass.exe being requested via either Event Codes 4656, where Object_name contains lsass.exe and Access_Mask is 0x143A or 0x1410. With access_mask of 0x1410 needs to be anded with Process_name ending with shell.exe to reduce FPs. Sample Splunk query:
EventCode=4656 | where ((Object_Name LIKE "%lsass.exe" AND Access_Mask=="0x143A") OR (Process_Name LIKE "%shell.exe" AND Object_Name LIKE "%lsass.exe" AND Access_Mask=="0x1410")
|
Uses hta scripts to execute malware
|
Analyze all instances of mshta being executed
|
DynamicDNS used for C2
|
Analyze traffic going to DynamicDNS providers
|
Adversary accesses Exchange remotely for collection
|
Search for non-standard IPs logging into Exchange accounts
|
Quasar creates a mutex to mark that it is installed on a system
|
Look for the following mutex: QSR_MUTEX_[18 alphanumber upper/lower]
|
