Skip to content

Latest commit

 

History

History
199 lines (194 loc) · 3.06 KB

inmemory_load_of_hacktool.md

File metadata and controls

199 lines (194 loc) · 3.06 KB

Catch in memory loading of hack tools for example loading via a c2 framework such as CobaltStrike

Source: Recent Purple Team

MDE

let iocList = dynamic ([
"BOFNET",
"SharpUp",
"ReflectedDelegate",
'ADCollector',
'ADCSPwn',
'ADSearch',
'ADFSDump',
'AtYourService',
'BetterSafetyKatz',
'Certify',
'EDD',
'ForgeCert',
'DeployPrinterNightmare',
'Grouper2',
'Group3r',
'KrbRelay',
'KrbRelayUp',
'InveighZero',
'LockLess',
'PassTheCert',
'PurpleSharp',
'Rubeus',
'SafetyKatz',
'SauronEye',
'scout',
'SearchOutlook',
'Seatbelt',
'Sharp-SMBExec',
'SharpAllowedToAct',
'SharpAppLocker',
'SharpBlock',
'SharpBypassUAC',
'SharpChisel',
'SharpChrome',
'SharpChromium',
'SharpCloud',
'SharpCOM',
'SharpCrashEventLog',
'SharpDir',
'SharpDoor',
'SharpDPAPI',
'SharpDump',
'SharpEDRChecker',
'SharpExec',
'SharPersist',
'SharpFiles',
'SharpGPOAbuse',
'SharpHandler',
'SharpHose',
'SharpHound',
'SharpKatz',
'SharpLaps',
'SharpMapExec',
'SharpMiniDump',
'SharpMove',
'SharpPrinter',
'SharpNoPSExec',
'SharpRDP',
'SharpReg',
'SharpSCCM',
'SharpSecDump',
'SharpShares',
'SharpSphere',
'SharpSpray',
'SharpStay',
'SharpSvc',
'SharpSniper',
'SharpSQLPwn',
'SharpTask',
'SharpUp',
'SharpView',
'SharpWMI',
'SharpWebServer',
'SharpWifiGrabber',
'SharpZeroLogon',
'Shhmon',
'Snaffler',
'SqlClient',
'StandIn',
'StickyNotesExtract',
'SweetPotato',
'ThunderFox',
'TruffleSnout',
'TokenStomp',
'Watson',
'winPEAS',
'WMIReg',
'Whisker'
]);
DeviceEvents
| extend module = parse_json(AdditionalFields).ModuleILPathOrName
| where ActionType =~ "ClrUnbackedModuleLoaded" and module in~ (iocList) and InitiatingProcessFileName =~ "powershell.exe"

Sentinel

let iocList = dynamic ([
"BOFNET",
"SharpUp",
"ReflectedDelegate",
'ADCollector',
'ADCSPwn',
'ADSearch',
'ADFSDump',
'AtYourService',
'BetterSafetyKatz',
'Certify',
'EDD',
'ForgeCert',
'DeployPrinterNightmare',
'Grouper2',
'Group3r',
'KrbRelay',
'KrbRelayUp',
'InveighZero',
'LockLess',
'PassTheCert',
'PurpleSharp',
'Rubeus',
'SafetyKatz',
'SauronEye',
'scout',
'SearchOutlook',
'Seatbelt',
'Sharp-SMBExec',
'SharpAllowedToAct',
'SharpAppLocker',
'SharpBlock',
'SharpBypassUAC',
'SharpChisel',
'SharpChrome',
'SharpChromium',
'SharpCloud',
'SharpCOM',
'SharpCrashEventLog',
'SharpDir',
'SharpDoor',
'SharpDPAPI',
'SharpDump',
'SharpEDRChecker',
'SharpExec',
'SharPersist',
'SharpFiles',
'SharpGPOAbuse',
'SharpHandler',
'SharpHose',
'SharpHound',
'SharpKatz',
'SharpLaps',
'SharpMapExec',
'SharpMiniDump',
'SharpMove',
'SharpPrinter',
'SharpNoPSExec',
'SharpRDP',
'SharpReg',
'SharpSCCM',
'SharpSecDump',
'SharpShares',
'SharpSphere',
'SharpSpray',
'SharpStay',
'SharpSvc',
'SharpSniper',
'SharpSQLPwn',
'SharpTask',
'SharpUp',
'SharpView',
'SharpWMI',
'SharpWebServer',
'SharpWifiGrabber',
'SharpZeroLogon',
'Shhmon',
'Snaffler',
'SqlClient',
'StandIn',
'StickyNotesExtract',
'SweetPotato',
'ThunderFox',
'TruffleSnout',
'TokenStomp',
'Watson',
'winPEAS',
'WMIReg',
'Whisker'
]);
DeviceEvents
| extend module = parse_json(AdditionalFields).ModuleILPathOrName
| where ActionType =~ "ClrUnbackedModuleLoaded" and module in~ (iocList) and InitiatingProcessFileName =~ "powershell.exe"