admin/ditekshen-detection
1
0
Fork 0
mirror of https://github.com/ditekshen/detection synced 2026-06-08 13:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixes and updates to RMM yara, calmav and invenotry

Browse Source
This commit is contained in:
ditekshen
2023-08-23 14:33:56 +03:00
parent 61a0009bbb
commit 7442eeef89
4 changed files with 93 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RMM_Inventory.csv
+21 -7
View File
@@ -1,10 +1,14 @@
App,CompanyName (Vendor),ProductName,FileDescription,InternalName,Yara,ClamAV,Domains,Snort AppID
"FleetDeck Commander
FleetDeck Commander Service",FleetDeck Inc,FleetDeck Commander,FleetDeck Commander,"fleetdeck_installer
FleetDeck Commander Service","FleetDeck Inc
FleetDeck, inc
FleetDeck Inc.",FleetDeck Commander,FleetDeck Commander,"fleetdeck_installer
fleetdeck_commander_svc.exe","INDICATOR_RMM_FleetDeck_Commander
INDICATOR_RMM_FleetDeck_Commander_SVC
INDICATOR_RMM_FleetDeck_Commander_Launcher
INDICATOR_RMM_FleetDeck_CERT",INDICATOR.Win.RMM.FleetDeckCommander,"relay.dev1.fleetdeck.io
INDICATOR_RMM_FleetDeck_CERT","INDICATOR.Win.RMM.FleetDeckCommander
INDICATOR.Win.RMM.FleetDeckCommander-SVC
INDICATOR.Win.RMM.FleetDeckCommander-Launcher","relay.dev1.fleetdeck.io
mqtt.dev1.fleetdeck.io
agentregister.dev1.fleetdeck.io
relay.test.fleetdeck.io
@@ -43,13 +47,24 @@ INDICATOR_RMM_ConnectWise_ScreenConnect_CERT",INDICATOR.Win.RMM.ConnectWise-Scre
*-web.screenconnect.com
cloud.screenconnect.com",
PDQConnect,PDQ.com,PDQConnectAgent,PDQ Connect Agent,NA,"INDICATOR_RMM_PDQConnect_Agent
INDICATOR_RMM_PDQConnect_Agent_CERT",,"app.pdq.com
INDICATOR_RMM_PDQConnect_Agent_CERT",INDICATOR.Win.RMM.PDQConnectAgent,"app.pdq.com
auth.pdq.com
connect.pdq.com
*.ingest.sentry.io
pdqconnect.zendesk.com",
Pulseway,,,,,,,,
Anydesk,,,,,,,,
pdqconnect.zendesk.com
adminarsenal.zendesk.com
help.pdq.com",
Pulseway pcmontask,"MMSOFT Design
MMSOFT Design Ltd.",Pulseway User Agent,Pulseway User Agent,pcmontask.exe,"INDICATOR_RMM_PulseWay_PCMonTaskSrv
INDICATOR_RMM_PulseWay_CERT",INDICATOR.Win.RMM.PulseWay,computermonitor.mmsoft.ro,
Pulseway pcmonitorsrv,"MMSOFT Design
MMSOFT Design Ltd.",Pulseway,Pulseway Service,PCMonitorSrv.exe,"INDICATOR_RMM_PulseWay_PCMonTaskSrv
INDICATOR_RMM_PulseWay_CERT",INDICATOR.Win.RMM.PulseWay,computermonitor.mmsoft.ro,
Pulseway Remote Control,"MMSOFT Design
MMSOFT Design Ltd.",Pulseway Remote Control,Pulseway Remote Control,RemoteDesktop.exe,"INDICATOR_RMM_PulseWay_RemoteDesktop
INDICATOR_RMM_PulseWay_CERT",INDICATOR.Win.RMM.PulseWay,,
Anydesk,"philandro Software GmbH
AnyDesk Software GmbH",,,,,,,
RemotePC,,,,,,,,
Remote Utilities,,,,,,,,
Kaseya,,,,,,,,
@@ -75,4 +90,3 @@ PCAnywhere,,,,,,,,
Xage,,,,,,,,
XONA Systems,,,,,,,,
Zscaler,,,,,,,,
,,,,,,,,
1 App CompanyName (Vendor) ProductName FileDescription InternalName Yara ClamAV Domains Snort AppID
2 FleetDeck Commander FleetDeck Commander Service FleetDeck Inc FleetDeck Inc FleetDeck, inc FleetDeck Inc. FleetDeck Commander FleetDeck Commander fleetdeck_installer fleetdeck_commander_svc.exe INDICATOR_RMM_FleetDeck_Commander INDICATOR_RMM_FleetDeck_Commander_SVC INDICATOR_RMM_FleetDeck_Commander_Launcher INDICATOR_RMM_FleetDeck_CERT INDICATOR.Win.RMM.FleetDeckCommander INDICATOR.Win.RMM.FleetDeckCommander INDICATOR.Win.RMM.FleetDeckCommander-SVC INDICATOR.Win.RMM.FleetDeckCommander-Launcher relay.dev1.fleetdeck.io mqtt.dev1.fleetdeck.io agentregister.dev1.fleetdeck.io relay.test.fleetdeck.io agentregister.test.fleetdeck.io relay.fleetdeck.io mqtt.fleetdeck.io agentregister.fleetdeck.io commanderupdate.fleetdeck.io *.fleetdeck.io commanderapi.fleetdeck.io commanderinstall.fleetdeck.io commanderupdate.fleetdeck.io fleetdm.com
3 FleetDeck Agent FleetDeck Inc. FleetDeck Agent FleetDeck Agent NA INDICATOR_RMM_FleetDeck_Agent INDICATOR_RMM_FleetDeck_CERT INDICATOR.Win.RMM.FleetDeckAgent relay.dev1.fleetdeck.io mqtt.dev1.fleetdeck.io agentregister.dev1.fleetdeck.io relay.test.fleetdeck.io agentregister.test.fleetdeck.io relay.fleetdeck.io mqtt.fleetdeck.io agentregister.fleetdeck.io commanderupdate.fleetdeck.io *.fleetdeck.io commanderapi.fleetdeck.io commanderinstall.fleetdeck.io commanderupdate.fleetdeck.io fleetdm.com
4 Mesh Agent NA MeshCentral Agent MeshCentral Background Service Agent NA INDICATOR_RMM_MeshAgent INDICATOR_RMM_MeshAgent_CERT INDICATOR.Win.RMM.MeshAgent
5 MeshCentral Server Installer Open Source MeshCentral Server Installer MeshCentral Server Installer INDICATOR_RMM_MeshCentral_CERT
6 Mesh Agent ConnectWise Control (formerly ScreenConnect) NA ScreenConnect Software MeshCentral Agent ScreenConnect ScreenConnect Client* MeshCentral Background Service Agent NA NA INDICATOR_RMM_MeshAgent INDICATOR_RMM_MeshAgent_CERT INDICATOR_RMM_ConnectWise_ScreenConnect INDICATOR_RMM_ConnectWise_ScreenConnect_CERT INDICATOR.Win.RMM.MeshAgent INDICATOR.Win.RMM.ConnectWise-ScreenConnect *relay.screenconnect.com *demo.screenconnect.com *-web.screenconnect.com cloud.screenconnect.com
7 MeshCentral Server Installer PDQConnect Open Source PDQ.com MeshCentral Server Installer PDQConnectAgent MeshCentral Server Installer PDQ Connect Agent NA INDICATOR_RMM_MeshCentral_CERT INDICATOR_RMM_PDQConnect_Agent INDICATOR_RMM_PDQConnect_Agent_CERT INDICATOR.Win.RMM.PDQConnectAgent app.pdq.com auth.pdq.com connect.pdq.com *.ingest.sentry.io pdqconnect.zendesk.com adminarsenal.zendesk.com help.pdq.com
8 ConnectWise Control (formerly ScreenConnect) Pulseway pcmontask ScreenConnect Software MMSOFT Design MMSOFT Design Ltd. ScreenConnect ScreenConnect Client* Pulseway User Agent NA Pulseway User Agent NA pcmontask.exe INDICATOR_RMM_ConnectWise_ScreenConnect INDICATOR_RMM_ConnectWise_ScreenConnect_CERT INDICATOR_RMM_PulseWay_PCMonTaskSrv INDICATOR_RMM_PulseWay_CERT INDICATOR.Win.RMM.ConnectWise-ScreenConnect INDICATOR.Win.RMM.PulseWay *relay.screenconnect.com *demo.screenconnect.com *-web.screenconnect.com cloud.screenconnect.com computermonitor.mmsoft.ro
9 PDQConnect Pulseway pcmonitorsrv PDQ.com MMSOFT Design MMSOFT Design Ltd. PDQConnectAgent Pulseway PDQ Connect Agent Pulseway Service NA PCMonitorSrv.exe INDICATOR_RMM_PDQConnect_Agent INDICATOR_RMM_PDQConnect_Agent_CERT INDICATOR_RMM_PulseWay_PCMonTaskSrv INDICATOR_RMM_PulseWay_CERT INDICATOR.Win.RMM.PulseWay app.pdq.com auth.pdq.com connect.pdq.com *.ingest.sentry.io pdqconnect.zendesk.com computermonitor.mmsoft.ro
10 Pulseway Remote Control MMSOFT Design MMSOFT Design Ltd. Pulseway Remote Control Pulseway Remote Control RemoteDesktop.exe INDICATOR_RMM_PulseWay_RemoteDesktop INDICATOR_RMM_PulseWay_CERT INDICATOR.Win.RMM.PulseWay
11 Anydesk philandro Software GmbH AnyDesk Software GmbH
12 Pulseway RemotePC
13 Anydesk Remote Utilities
14 RemotePC Kaseya
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
90
91
92
clamav/clamav.ldb
+3
View File
@@ -145,3 +145,6 @@ ditekSHen.MALWARE.Linux.Trojan.GetShell;Engine:51-255,Target:6;((0&1)|(2&3))&(4|
ditekSHen.MALWARE.Win.Trojan.RookIE-Downloader;Engine:51-255,Target:1;0&1&2&3;7368656c6c3a3a3a7b32353539613166332d323164372d313164342d626461662d3030633034663630623966307d;7461736b6b696c6c202f66202f696d2068682e657865;526f6f6b49452f312e30;233332373730
ditekSHen.MALWARE.Win.Trojan.LummaStealer;Engine:51-255,Target:1;(0|1)&(3|4|5)&(6|7|8);6332736f636b::w;6332636f6e66::w;2d20436f6d70757465724e616d65446e73486f73746e616d653a;2d20436f6d70757465724e616d654e657442494f533a;2d20506879736963616c20496e7374616c6c6564204d656d6f72793a;2a2e656d6c::w;5465736c6142726f77736572::w;6c69643d2573;534f4654574152455c4d6963726f736f66745c57696e646f77735c43757272656e7456657273696f6e5c556e696e7374616c6c::w
ditekSHen.MALWARE.Win.Trojan.PovertyStealer;Engine:51-255,Target:1;(0|1|2|3|4)>2;506f76657274792069732074686520706172656e74206f66206372696d65;4f7065726174696f6e53797374656d3a2025643a25643a2564;53637265656e53697a653a207b6c57696474683d25642c206c4865696768743d25647d;566964656f41646170746572202325643a202573;24642e6c6f67::w
ditekSHen.MALWARE.Win.Trojan.RDPCredsStealer-Injector;Engine:51-255,Target:1;0&(1|2|3)&(4|5|6);415049486f6f6b496e6a6563746f72;436f646520496e6a6563746564;444c4c20496e6a6563746564;5244504372656473537465616c6572444c4c;4f70656e50726f636573732829206661696c65643a;5669727475616c416c6c6f6345782829206661696c65643a;43726561746552656d6f74655468726561642829206661696c65643a
ditekSHen.INDICATOR.Win.TOOL.BURNTCIGAR;Engine:51-255,Target:1;0&1&2&3;4b696c6c20504944203d;43726561746546696c65204572726f72203d;4b696c6c4156;446576696365496f436f6e74726f6c
ditekSHen.INDICATOR.Win.TOOL.WEDGECUT;Engine:51-255,Target:1;(0&1&2)&(3|4|5)>1;49636d7053656e644563686f;49636d70436c6f736548616e646c65;49636d7043726561746546696c65;436865636b4f6e6c696e65;2d6e616d65;2d66756c6c
clamav/indicator_rmm.ldb
+9
View File
@@ -0,0 +1,9 @@
ditekSHen.INDICATOR.Win.RMM.MeshAgent;Engine:51-255,Target:1;((0|1|2|3)&(4|5|6|7)>1)|(4&5&6&7);5c4d6573684167656e74::w;4d657368204167656e74::w;4d65736844756d6d79::w;4d65736843656e7472616c::w;494c696252656d6f74654c6f6767696e672e63;4167656e74436f72652f4d6573685365727665725f::w;636f6e736f6c652e6c6f672867657453484133383446696c65486173682870726f636573732e6578656350617468292e746f537472696e672827686578272929;7b226167656e74223a22
ditekSHen.INDICATOR.Win.RMM.ConnectWise-ScreenConnect;Engine:51-255,Target:1;(0|1|2|3|4|5)>3;46494c45535953435245454e434f4e4e4543542e434f52452c2056455253494f4e3d::w;666565646261636b2e73637265656e636f6e6e6563742e636f6d2f466565646261636b2e617864::w;53637265656e436f6e6e65637420436c69656e74::w;53637265656e436f6e6e6563742e496e7374616c6c6572416374696f6e732153637265656e436f6e6e6563742e::w;53637265656e436f6e6e6563742e436f72652e706462;5c5c2e5c506970655c5465726d696e616c5365727665725c53797374656d45786563537276725c::w
ditekSHen.INDICATOR.Win.RMM.FleetDeckAgent;Engine:51-255,Target:1;((0|1)&(2|3|4|5|6)>2)|(2&3&4&5&6);666c6565746465636b2e696f2f;6c6f616420466c6565744465636b206167656e74;72656d6f74654465736b746f7053657373696f6e4d75746578;6d61696e2e7669727475616c5465726d696e616c5761746368646f67;6d61696e2e6d65657452656d6f74654465736b746f70;7265706f2e73656e72692e73652f70726f746f74797065332f;6d61696e2e737663497063436c69656e74
ditekSHen.INDICATOR.Win.RMM.FleetDeckCommander;Engine:51-255,Target:1;0&1&2&3;536f6674776172655c4d6963726f736f66745c466c6565744465636b20436f6d6d616e646572;7c466c6565744465636b20436f6d6d616e646572;666c6565746465636b2e696f2f70726f746f74797065332f;633a5c6167656e745c5f776f726b5c36365c735c
ditekSHen.INDICATOR.Win.RMM.FleetDeckCommander-SVC;Engine:51-255,Target:1;(0|1|2|3)>2;666c6565746465636b666f726b2f6578656366756e636172677328;666c6565746465636b2e696f2f70726f746f74797065332f636f6d6d616e6465725f737663;70726f636565643a202a2e666c6565746465636b2e696f;5245472041444420484b45595f434c41535345535f524f4f545c2573202f56202255524c2050726f746f636f6c22202f54205245475f535a202f46
ditekSHen.INDICATOR.Win.RMM.FleetDeckCommander-Launcher;Engine:51-255,Target:1;0&1;666c6565746465636b2e696f2f70726f746f74797065332f636f6d6d616e6465725f6c61756e63686572;466c6565744465636b20436f6d6d616e646572204c61756e63686572
ditekSHen.INDICATOR.Win.RMM.PDQConnectAgent;Engine:51-255,Target:1;((0|1|2|3|4|5|6|7|8|9|10)>4)|((11&12&13&14&15)&(0|1|2|3|4|5|6|7|8|9|10));7369676e5f7064712e7273;782d7064712d6461746543726564656e7469616c3d282e2b3f292f;7064712d636f6e6e6563742d6167656e74;50445120436f6e6e656374204167656e74;504451436f6e6e6563744167656e74;504451436f6e6e6563744167656e747372635c6c6f676765722e7273;2d5044512d4b65792d496473557365722d4167656e74;5c5044515c504451436f6e6e6563744167656e745c;5c7064715f636f6e6e6563745f6167656e742e706462;7461736b5f6964735b5d50445120726f766572;6170702e7064712e636f6d;2f646576696365732f7265676973746572;2f646576696365732f736f636b65742f776562736f636b65743f6465766963655f69643d;2f646576696365732f7461736b73;2f646576696365732f617574682d6368616c6c656e6765;2f646576696365732f72656365697665722f55726c
ditekSHen.INDICATOR.Win.RMM.PulseWay;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8)>7;4d4d2e4d6f6e69746f722e;52444167656e7453657373696f6e53657474696e677356;436865636b466f724d61634f5352656d6f74654465736b746f70557064617465436f6d706c657465644576656e74;436f6e6669726d4167656e7453746172746564;47657453637265656e73686f74;556e6c6f616452656d6f74654465736b746f70446c6c73;4374726c416c7444656c65746550726f63;2437636663336238382d366463342d343966632d396630612d626639653931313361313464;636f6d70757465726d6f6e69746f722e6d6d736f66742e726f
ditekSHen.INDICATOR.Win.RMM.PulseWay;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8)>7;4d4d2e4d6f6e69746f722e;52444167656e7453657373696f6e53657474696e677356;436865636b466f724d61634f5352656d6f74654465736b746f70557064617465436f6d706c657465644576656e74;436f6e6669726d4167656e7453746172746564;47657453637265656e73686f74;556e6c6f616452656d6f74654465736b746f70446c6c73;4374726c416c7444656c65746550726f63;2437636663336238382d366463342d343966632d396630612d626639653931313361313464;636f6d70757465726d6f6e69746f722e6d6d736f66742e726f
yara/indicator_rmm.yar
+60 -61
View File
@@ -1,64 +1,4 @@
rule MALWARE_Win_RDPCredsStealer {
meta:
author = "ditekSHen"
description = "Detects RDP Credentials Stealer"
clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer"
strings:
$x1 = "MyCredUnPackAuthenticationBufferW Hooked Function" ascii
$x2 = "\\RDPCredsStealerDLL\\" ascii
$x3 = "\\RDPCreds.txt" ascii
$s1 = "CredUnPackAuthenticationBufferW" ascii
$s2 = "Installing Hooked Function" ascii
$s3 = "SymLoadModule64" fullword ascii
$s4 = "memmove" fullword ascii
condition:
uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or 3 of ($s*))
}
rule MALWARE_Win_RDPCredsStealerInjector {
meta:
author = "ditekSHen"
description = "Detects RDP Credentials Stealer injector"
clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer-Injector"
strings:
$s1 = "\\APIHookInjectorBin\\" ascii
$s2 = "\\RDPCredsStealerDLL.dll" ascii
$s3 = "DLL Injected" ascii
$s4 = "Code Injected" ascii
$s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii
condition:
uint16(0) == 0x5a4d and 3 of them
}
rule INDICATOR_TOOL_BURTNCIGAR {
meta:
author = "ditekSHen"
description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software"
clamav1 = "INDICATOR.Win.TOOL.BURNTCIGAR"
strings:
$s1 = "Kill PID =" ascii
$s2 = "CreateFile Error =" ascii
$s3 = "\\KillAV" ascii
$s4 = "DeviceIoControl" ascii
condition:
uint16(0) == 0x5a4d and 3 of them
}
rule INDICATOR_TOOL_WEDGECUT {
meta:
author = "ditekSHen"
description = "Detects WEDGECUT a reconnaissance tool to checks hosts are online using ICMP packets"
clamav1 = "INDICATOR.Win.TOOL.WEDGECUT"
strings:
$s1 = "-name" fullword ascii
$s2 = "-full" fullword ascii
$s3 = "\\CheckOnline" ascii
$s4 = "IcmpSendEcho" fullword ascii
$s5 = "IcmpCloseHandle" fullword ascii
$s6 = "IcmpCreateFile" fullword ascii
condition:
uint16(0) == 0x5a4d and 4 of them
}
import "pe"
rule INDICATOR_RMM_MeshAgent {
meta:
@@ -299,3 +239,62 @@ rule INDICATOR_RMM_PDQConnect_Agent_CERT {
pe.signatures[i].subject contains "PDQ.com Corporation"
)
}
rule INDICATOR_RMM_PulseWay_PCMonTaskSrv {
meta:
author = "ditekSHen"
description = "Detects Pulseway pcmontask and service user agent responsible for Remote Control, Screens View, Computer Lock, etc"
clamav1 = "INDICATOR.Win.RMM.PulseWay"
reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv"
reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a"
reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf"
reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
strings:
$s1 = "MM.Monitor." ascii
$s2 = "RDAgentSessionSettingsV" ascii
$s3 = "CheckForMacOSRemoteDesktopUpdateCompletedEvent" ascii
$s4 = "ConfirmAgentStarted" ascii
$s5 = "GetScreenshot" ascii
$s6 = "UnloadRemoteDesktopDlls" ascii
$s7 = "CtrlAltDeleteProc" ascii
$s8 = "$7cfc3b88-6dc4-49fc-9f0a-bf9e9113a14d" ascii
$s9 = "computermonitor.mmsoft.ro" ascii
condition:
(uint16(0) == 0x5a4d or uint16(0) == 0xcfd0) and 7 of them
}
rule INDICATOR_RMM_PulseWay_RemoteDesktop {
meta:
author = "ditekSHen"
description = "Detects Pulseway Rempte Desktop client"
clamav1 = "INDICATOR.Win.RMM.PulseWay"
reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv"
reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a"
reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf"
reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
strings:
$s1 = "RemoteControl" ascii
$s2 = "MM.Monitor.RemoteDesktopClient." ascii
$s3 = "MM.Monitor.RemoteControl" ascii
$s4 = "RemoteDesktopClientUpdateInfo" ascii
$s5 = "ShowRemoteDesktopEnabledSystemsOnly" ascii
$s6 = "$31f50968-d45c-49d6-ace9-ebc790855a51" ascii
condition:
(uint16(0) == 0x5a4d or uint16(0) == 0xcfd0) and 5 of them
}
rule INDICATOR_RMM_PulseWay_CERT {
meta:
author = "ditekSHen"
description = "Detects PulseWay by (default) certificate. Review RMM Inventory"
reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv"
reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a"
reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf"
reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
condition:
uint16(0) == 0x5a4d and
for any i in (0..pe.number_of_signatures): (
pe.signatures[i].issuer contains "DigiCert, Inc." and
pe.signatures[i].subject contains "MMSOFT Design Ltd."
)
}