Operation Mirror Sphere
Indicators of Compromise
No domains found for this campaign
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
REMEDIATION
T1190-Exploit Public-Facing Application
ID | Data Source | Data Component | Detects |
Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Web Application Firewalls may detect improper inputs attempting exploitation. Web server logs (e.g., var/log/httpd or /var/log/apache for Apache web servers on Linux) may also record evidence of exploitation. (source="C:\inetpub\logs\LogFiles\W3SVC*" OR source="/var/log/apache2/access.log" OR source="/var/log/nginx/access.log")| eval exploit_attempt=if(like(cs_uri_query, "%exec%") OR like(cs_uri_query, "%cmd%") OR like(cs_uri_query, "%cat /etc/passwd%") OR like(cs_uri_query, "%../../%"), 1, 0)| stats count by src_ip, cs_uri_query, sc_status| where exploit_attempt=1 AND count > 5| table _time, src_ip, cs_uri_query, sc_status, count | |||
Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection strings or known payloads. For example, monitor for successively chained functions that adversaries commonly abuse (i.e. gadget chaining) through unsafe deserialization to exploit publicly facing applications for initial access.[114] In AWS environments, monitor VPC flow logs and/or Elastic Load Balancer (ELB) logs going to and from instances hosting externally accessible applications. (source="/var/log/zeek/http.log" OR source="C:\Windows\System32\LogFiles\Firewall")| regex http_request="(?i)select.from|union.select|cmd=.|exec=."| stats count by src_ip, dest_ip, http_method, uri_path| where count > 10| table _time, src_ip, dest_ip, http_method, uri_path, count |
T1210-Exploitation of Remote Services
ID | Data Source | Data Component | Detects |
Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Web Application Firewalls may detect improper inputs attempting exploitation. sourcetype="WinEventLog:System" (EventCode=7031 OR EventCode=1000) OR sourcetype="linux:syslog" OR sourcetype="macos:system"| search Message="service terminated unexpectedly" OR Message="segmentation fault" OR Message="service restart"| stats count by Host, ServiceName, Message, _time| eval exploitation_suspicious=if(count > threshold OR match(Message, "segmentation fault|service terminated unexpectedly"), "suspicious", "normal")| where exploitation_suspicious="suspicious"| table _time, Host, ServiceName, Message, exploitation_suspicious | |||
Use deep packet inspection to look for artifacts of common exploit traffic, such as known payloads. sourcetype="network:packet_capture" OR sourcetype="ids:alert"| search (alert IN ("SMB Exploit Detected", "RDP Exploit Attempt", "MySQL Exploit Attempt")) OR (src_port IN (445, 3389, 3306))| stats count by src_ip, dest_ip, dest_port, protocol, signature, _time| eval anomaly_detected=if(count > threshold OR match(signature, "Exploit Attempt|Remote Code Execution"), "suspicious", "normal")| where anomaly_detected="suspicious"| table _time, src_ip, dest_ip, dest_port, protocol, signature, anomaly_detected |
T1602.001-Data from Configuration Repository: SNMP (MIB Dump)
ID | Data Source | Data Component | Detects |
Monitor for newly constructed network connections that are sent or received by untrusted hosts or uncommon data flows. Consider analyzing packet contents to detect application layer protocols, leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows(e.g. snmp traffic originating from unauthorized or untrusted hosts, signature detection for strings mapped to device configuration(s), and anomolies in snmp request(s)) | |||
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flow (e.g. snmp traffic originating from unauthorized or untrusted hosts, signature detection for strings mapped to device configuration(s), and anomolies in snmp request(s)) |
T1068-Exploitation for Privilege Escalation
ID | Data Source | Data Component | Detects |
Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of Process Injection for attempts to hide execution or evidence of Discovery. Consider monitoring for the presence or loading (ex: Sysmon Event ID 6) of known vulnerable drivers that adversaries may drop and exploit to execute code in kernel mode.[52] Higher privileges are often necessary to perform additional actions such as some methods of OS Credential Dumping. Look for additional activity that may indicate an adversary has gained higher privileges. | |||
Monitor for newly executed processes that may exploit software vulnerabilities in an attempt to elevate privileges. After gaining initial access to a system, threat actors attempt to escalate privileges as they may be operating within a lower privileged process which does not allow them to access protected information or carry out tasks which require higher permissions. A common way of escalating privileges in a system is by externally invoking and exploiting spoolsv or connhost executables, both of which are legitimate Windows applications. This query searches for an invocation of either of these executables by a user, thus alerting us of any potentially malicious activity. Note: Event IDs are for Sysmon (Event ID 1 - process create) and Windows Security Log (Event ID 4688 - a new process has been created). The Analytic is oriented around looking for an invocation of either spoolsv.exe or conhost.exe by a user, thus alerting us of any potentially malicious activity. A common way of escalating privileges in a system is by externally invoking and exploiting these executables, both of which are legitimate Windows applications. Analytic 1 - Unusual Child Process for spoolsv.exe or connhost.exe (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="WinEventLog:Security" EventCode="4688") (Image="C:\Windows\System32\spoolsv.exe" OR Image="C:\Windows\System32\conhost.exe") AND ParentImage= "C:\Windows\System32\cmd.exe") |