Open
Conversation
RavenTait
requested review from
ljstella,
nasbench and
patel-bhavin
as code owners
Contributor
|
|
|
||
| PowGoop is the primary loader used by MuddyWater (also tracked as SeedWorm, Static Kitten, and MERCURY) and has been their main initial access loader since at least 2020. It abuses DLL side-loading against a fake GoogleUpdate.exe to execute a multi-stage decoding chain, a fully functional PowerShell backdoor disguised with a benign extension. The config.txt contains a hardcoded C2 address and victim GUID, beacons via modified base64-encoded HTTP, and runs C2 traffic under the legitimate Google Update process to evade network detection. | ||
|
|
||
| ' |
Contributor
There was a problem hiding this comment.
Can we update the script to remove this extra line from the description?
| ' | ||
| data_source: | ||
| - Sysmon EventID 11 | ||
| search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*cred64.dll", "*clip64.dll") by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name Filesystem.action Filesystem.vendor_product Filesystem.user| `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_amadey_file_indicators_filter`' |
Contributor
There was a problem hiding this comment.
can we instead target the file_name IN ("cred64.dll", "clip64.dll") . that said, I am not sure if we want to ship detections that look for specific file based indicators.
@nasbench - any thoughts?
| threat_objects: [] | ||
| tags: | ||
| analytic_story: | ||
| - Compromised Windows Host |
Contributor
There was a problem hiding this comment.
better served with Amadey analytic story
| search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' | ||
| - earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| name: View risk events for the last 7 days for - "$user$" and "$dest$" |
Contributor
There was a problem hiding this comment.
lets update all the drilldowns in this PR to use the latest configs :
name: starthoursago=168
search: <remove
earliest_offset: 7d
latest_offset: "0"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First Big chunk of detections from SnapAttack
Contains 109 new detections and some new malicious powershell strings.