Read on Twitter
This is great work by @MichalKoczwara! Maybe hidden to some, is the Beacon configuration. Specifically Spawnto_*.
This list provides insight to what actors are using to inject into with CobaltStrike -->
https://twitter.com/MichalKoczwara/status/1341659356866240517
This list provides insight to what actors are using to inject into with CobaltStrike -->
https://twitter.com/MichalKoczwara/status/1341659356866240517
spawnto... is actually two settings, that change the program Cobalt Strike opens and injects shellcode into. In other words: any time Cobalt Strike starts a new Beacon process, the process will be the one designated by spawnto. The default is rundll32.exe. https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/
What can we learn from this work by @MichalKoczwara?
The majority use the default (rundll32), and as it tapers off we see some interesting processes used:
rundll32.exe401
gpupdate.exe16
svchost.exe8
mstsc.exe6
WerFault.exe3
dllhost.exe3
mavinject.exe3
The majority use the default (rundll32), and as it tapers off we see some interesting processes used:
rundll32.exe401
gpupdate.exe16
svchost.exe8
mstsc.exe6
WerFault.exe3
dllhost.exe3
mavinject.exe3
gpresult.exe2
net.exe2
wusa.exe2
WUAUCLT.exe1
cmstp.exe1
compact.exe1
eventvwr.exe1
iexplore.exe1
lsass.exe1
regsvr32.exe1
w32tm.exe1
net.exe2
wusa.exe2
WUAUCLT.exe1
cmstp.exe1
compact.exe1
eventvwr.exe1
iexplore.exe1
lsass.exe1
regsvr32.exe1
w32tm.exe1
How can defenders use this? I recommend reviewing, with the data we have, normal process lineage of each of these. Ask (for each):
Does wusa.exe spawn from explorer.exe?
When gpresult.exe is used, does it normally have command line arguments?
Does wusa.exe spawn from explorer.exe?
When gpresult.exe is used, does it normally have command line arguments?
Some of this was disclosed in the @FireEye Red Team tools https://github.com/fireeye/red_team_tool_countermeasures, under the name "BEACON". Above we saw what is public, but what was the FireEye Red Team doing?
Quick breakdown -
spawnto_:
SYMERR
Microsoft WorkFlow Compiler
SEARCH INDEXER
SEARCHPROTOCOLHOST
ask the same questions as before.
Moved/renamed:
msbuild
regsvr32
Microsoft WorkFlow Compiler
spawnto_:
SYMERR
Microsoft WorkFlow Compiler
SEARCH INDEXER
SEARCHPROTOCOLHOST
ask the same questions as before.
Moved/renamed:
msbuild
regsvr32
Microsoft WorkFlow Compiler
Gist for posterity - https://gist.github.com/MHaggis/bdcd0e6d5c727e5b297a3e69e6c52286
