Empire

Attackers purchased domains to be used as a command and control.

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

PSinjectの仕組み自体は以前実装したことがあり、Unmanaged Codeから.NET CLRを起動し、CLR経由でManaged Codeを実行する

The stager file hides its window and changes the PowerShell execution policy.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Adversaries may create a local account to maintain access to victim systems. ... Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Adversaries may create a domain account to maintain access to victim systems. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.

The follow-up malware will override the CLSID '{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}' to gain persistence in the victims' system, performing a COM Hijacking technique.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

ReflectivePick allows PowerShell Empire to inject and bootstrap PowerShell into any running process... Empire allows you to inject an agent into any process by remotely bootstrapping PowerShell.

The follow-up malware will override the CLSID '{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}' to gain persistence in the victims' system, performing a COM Hijacking technique.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

ReflectivePick allows PowerShell Empire to inject and bootstrap PowerShell into any running process... Empire allows you to inject an agent into any process by remotely bootstrapping PowerShell.

The file was embedded into a Graphite shellcode task used to reflectively load the executable into the memory of the process and execute it.

After running PowerDump, the group quickly deleted PowerShell event logs to erase records generated by Script Block Logging.

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Empire-style browser history retrieval; profile enumeration.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

SMB-based lateral generally starts by copying a payload to the remote target. | Unfortunately, this is where SMB steps in and provides options for abuse.

Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.

This would have eventually provided network access to the DoppelPayer actors who would then have used Cobalt Strike and PowerShell Empire to spread the ransomware laterally through the rest of the network.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Most cyber activity by malicious actors requires infrastructure like servers on the internet. Some APT groups used several thousand Command and Control (C2) servers over the years. | Also, this article covers only HTTP(S) based infrastructure.

CloudFlare WorkerをリダイレクタとしたC2環境を構築し、Stager経由でC2セッションを張る

Adversaries created multiple stages to obfuscate the command-and-control channel and to make detection more difficult.

Stager経由でC2セッションを張る

The data is compressed using the LZNT1 algorithm and encrypted with a hardcoded AES-256-CBC key with a random IV. The operator tasks are encoded in the same way.