Try in Splunk Security Cloud

Description

CISA and the FBI have identified an APT activity where the adversary gained initial access via Log4Shell via a unpatched VMware Horizon server. From there the adversary moved laterally and continued to its objective.

Narrative

From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence. CISA and the Federal Bureau of Investigation (FBI) assess that the FCEB network was compromised by Iranian government-sponsored APT actors.

Detections

Name Technique Type
Add or Set Windows Defender Exclusion Disable or Modify Tools, Impair Defenses TTP
Detect Mimikatz Using Loaded Images LSASS Memory, OS Credential Dumping TTP
Detect Mimikatz With PowerShell Script Block Logging OS Credential Dumping, PowerShell TTP
Detect PsExec With accepteula Flag Remote Services, SMB/Windows Admin Shares TTP
Detect Renamed PSExec System Services, Service Execution Hunting
Enable WDigest UseLogonCredential Registry Modify Registry, OS Credential Dumping TTP
GetAdComputer with PowerShell Script Block Remote System Discovery Hunting
Hunting for Log4Shell Exploit Public-Facing Application Hunting
Log4Shell CVE-2021-44228 Exploitation Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter Correlation
Log4Shell JNDI Payload Injection Attempt Exploit Public-Facing Application Anomaly
Log4Shell JNDI Payload Injection with Outbound Connection Exploit Public-Facing Application Anomaly
Malicious PowerShell Process - Encoded Command Obfuscated Files or Information Hunting
Mimikatz PassTheTicket CommandLine Parameters Use Alternate Authentication Material, Pass the Ticket TTP
Ngrok Reverse Proxy on Network Protocol Tunneling, Proxy, Web Service Anomaly
Powershell Windows Defender Exclusion Commands Disable or Modify Tools, Impair Defenses TTP
Suspicious Driver Loaded Path Windows Service, Create or Modify System Process TTP
Suspicious Powershell Command-Line Arguments PowerShell TTP
Windows Driver Load Non-Standard Path Rootkit, Exploitation for Privilege Escalation TTP
Windows Drivers Loaded by Signature Rootkit, Exploitation for Privilege Escalation Hunting
Windows Mimikatz Binary Execution OS Credential Dumping TTP
Windows Ngrok Reverse Proxy Usage Protocol Tunneling, Proxy, Web Service Anomaly
Windows Service Create Kernel Mode Driver Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation TTP
XMRIG Driver Loaded Windows Service, Create or Modify System Process TTP

Reference

source | version: 1