[New Blog📚] A Shared Arsenal: Identifying Common TTPs Across RATs
Check out this latest Splunk blog by @tccontre18 and I, where we've looked at multiple RAT families based on open intel and our past research, to identify common TTPs.
https://t.co/64OQXBq8YZ
#Oyster Loader #MalwareAnalysis is out. Please let me know what you think, if it's helpful, and what needs to be improved on for the next one. Thanks to my colleagues for help on this and the heavy lifting. I learned a lot doing this.
https://t.co/EeHwb2k33N
🚨 How I Traced a Malware Infection in Network Traffic from DNS Query to Data Exfiltration using Wireshark
Incident report summary available below 👇
A thread (🧵)
Before anyone noticed, an infected machine checked its public IP, established a connection with a remote server, and began exfiltrating data. But how did it happen?
Here’s how I uncovered the attack—step by step. 🧵👇
''MalDoc in PDF - Detection bypass by embedding a malicious Word file into a PDF file – - JPCERT/CC Eyes''
#infosec#pentest#redteam#blueteam
https://t.co/QIWN2S35OS
Talking to a friend now I remembered something. Back in 2018, when I started learning about windows internals, me and my friends started this strict habit to take 10 exe/DLLs from System32 directory and just google/read up about them. No fancy hacks, no reversing, nothing. We did this for around 60 days and amount of knowledge just by googling was insane. You dont need books, or courses to learn anything (although I sell a few). Its all about giving a dedicated time to a few things and following it up with discipline. People think about advanced things and get scared. But its always more about how good your fundamentals are. If you have a good understanding of basic fundamentals, everything else becomes much easier to learn.
Took a 2 week break from everything. Finally back. Time for an update to my older blog... "Evading every EDR on the Planet part 2..." SorryNotSorry defenders 🤓
Alternatives to 'whoami.exe'.
COM interface ideas:
- IADsADSystemInfo
- IADsWinNTSystemInfo
- IADsComputer
- WMI COM provider to query 'whoami.exe'
IADsADSystemInfo, IADsWinNTSystemInfo, and IADsComputer are all fundamentally similar in calling syntax and are pretty copy-pasta ish. Windows SDK is kind of a pain though, the GUIDs weren't located easily, so they needed to be manually defined.
Example: https://t.co/b9CJZzkybK
Advapi32 functionality:
- Advapi32!LookupAccountSidW
- Advapi32!LsaLookupSids
LookupAccountSidW is an internal wrapper that calls LsaOpenPolicy, LsaLookupSids, and subsequently LsaFreeMemory. LsaFreeMemory is a wrapper to RtlFreeHeap.
Example: https://t.co/1vFBV9Ib3Y
Other possibilities:
- NpGetUserName - gets the username from a named pipe. Requires spawning a secondary thread, creating a named pipe, connecting to it, impersonating it, ... it is a long story =D
- Offlinesame.dll - Offline sam has a lot of functionality for enumerating users and domains on the machine. This is undocumented and requires a little more work. However, it has been demonstrated loosely by @0gtweet
Example: https://t.co/DbdFNwFBri
tl;dr can't stop thinking about whoami.exe :(