For the initial access we will assume, as it is not included in the writeup, that the account used had an easily guessable password without brute forcing lockout protection. In this case being able to perform an IP reputation check is of little value unless we have some logs with high quality data points within. A set of common logs that would be relevant in this case and their value to security monitoring is shown below.

In this case having authentication logs for the RDP login would have shown there were logins to a server from Estonia and Iran. This would likely have resulted in an alarm worth looking further into. If firewall logs were the only logs available then it’s likely this access would be part of the general internet noise and not investigated.

Install.bat

The article then details the contents of an install script that was executed on the server. We have modified the actual commands, as there were typoes and commands that simply would not run on our test server. We only used a single example of each type. As always run these types of commands in dedicated test environment, as a lot of them while not malicious on their own may alter the system state.

@echo off
net stop TrustedDriver
echo,Y|icacls c:\windows\fonts\*.exe /T /Q /C /RESET
wmic process where ExecutablePath='c:\\windows\\Fonts\\svchost.exe' delete
del /q /f "c:\test"
attrib +s +h "c:\Windows\Fonts\svchost.exe"
taskkill /f /im wscipt.exe							
							

Some of the interesting commands are explained below;

• icacls - Used to show of modify Access Control Lists (ACLs) within Windows. In this case the command is setting all of the “.exe” files in fonts directory to the default inherited ACLs with the “/RESET” parameter.
• wmic - Provides a command line interface for the Windows Management Instrumentation (WMI) which allows for a huge range of management tasks to be performed within Windows. In this case it is being used to kill a process that matches the ‘where’ clause. It's an interesting use of WMIC.
• attrib - This command changes attributes. The use of ‘+h’ sets the file to hidden to hide it.

From this set of commands we can begin testing and altering or building new rules to capture some of the more suspicious activity. As can be seen above we have tested a few types of rules with varying degrees of success, the most difficult part of these types of activities is they often do not look radically different than some normal administrative tasks. There are two ways we create rules around these types of activities;

• Generic Rules - The above rule titles “Server – Discovery Commands” is an example of a generic rule where a number of discovery type commands are bunched into the rule. These rules are generally quite low confidence and we often auto close them after adding certain elements to rules for further monitoring.


• Specific Rules - For discovery commands and techniques where we can apply some more logic a specific rule may be created. In these rules we would look for the additional indicators that mark the event as different from a normal administrative action. For example in the “Server – Suspicious Command – Attrib” rule we need the “+h” parameter to be set for the rule to fire.

Ultimately there is a fine line between reducing false positives and removing the ability to detect something. In the case of the DFIR writeup the malware performs so many actions on such a short time frame it is hard to miss.

Registry key: HKLM\SOFTWARE\Classes\exefile\shell\open\command
Value: %SystemRoot%\svchost.com “%1” %*							
					

reg add HKLM\SOFTWARE\Classes\exefile\shell\open\command /v %SystemRoot%\hacker.com /t REG_SZ /d "“%1” %*"	
					

!--SYSMON EVENT ID 12 & 13 & 14 : REGISTRY MODIFICATION [RegistryEvent]--!
RegistryEvent onmatch="include"
TargetObject condition="contains">shell\open\command\ /TargetObject
					

net stop TrustedDriver
taskkill /f /im wscipt.exe
SCHTASKS /Delete /TN /SERVERQR /F&SCHTASKS /create /tn /SERVERQR /sc DAILY /mo 365 /tr "cmd /c echo,Y|calcs c:\windows\fonts*.exe /G everyone:f"
						

del /q /f "c:\test"
echo 127.0.0.1 seamlessintelligence.com.au>> %WINDIR%\system32\drivers\etc\hosts
start %windir%\fonts\hackerman.exe