From 7442eeef892dfca2f7d64df42ce07e0960ee14cd Mon Sep 17 00:00:00 2001 From: ditekshen Date: Wed, 23 Aug 2023 14:33:56 +0300 Subject: [PATCH] Fixes and updates to RMM yara, calmav and invenotry --- RMM_Inventory.csv | 28 ++++++--- clamav/clamav.ldb | 3 + clamav/indicator_rmm.ldb | 9 +++ yara/indicator_rmm.yar | 121 +++++++++++++++++++-------------------- 4 files changed, 93 insertions(+), 68 deletions(-) create mode 100644 clamav/indicator_rmm.ldb diff --git a/RMM_Inventory.csv b/RMM_Inventory.csv index 0d675d8..5b2f0ab 100644 --- a/RMM_Inventory.csv +++ b/RMM_Inventory.csv @@ -1,10 +1,14 @@ App,CompanyName (Vendor),ProductName,FileDescription,InternalName,Yara,ClamAV,Domains,Snort AppID "FleetDeck Commander -FleetDeck Commander Service",FleetDeck Inc,FleetDeck Commander,FleetDeck Commander,"fleetdeck_installer +FleetDeck Commander Service","FleetDeck Inc +FleetDeck, inc +FleetDeck Inc.",FleetDeck Commander,FleetDeck Commander,"fleetdeck_installer fleetdeck_commander_svc.exe","INDICATOR_RMM_FleetDeck_Commander INDICATOR_RMM_FleetDeck_Commander_SVC INDICATOR_RMM_FleetDeck_Commander_Launcher -INDICATOR_RMM_FleetDeck_CERT",INDICATOR.Win.RMM.FleetDeckCommander,"relay.dev1.fleetdeck.io +INDICATOR_RMM_FleetDeck_CERT","INDICATOR.Win.RMM.FleetDeckCommander +INDICATOR.Win.RMM.FleetDeckCommander-SVC +INDICATOR.Win.RMM.FleetDeckCommander-Launcher","relay.dev1.fleetdeck.io mqtt.dev1.fleetdeck.io agentregister.dev1.fleetdeck.io relay.test.fleetdeck.io @@ -43,13 +47,24 @@ INDICATOR_RMM_ConnectWise_ScreenConnect_CERT",INDICATOR.Win.RMM.ConnectWise-Scre *-web.screenconnect.com cloud.screenconnect.com", PDQConnect,PDQ.com,PDQConnectAgent,PDQ Connect Agent,NA,"INDICATOR_RMM_PDQConnect_Agent -INDICATOR_RMM_PDQConnect_Agent_CERT",,"app.pdq.com +INDICATOR_RMM_PDQConnect_Agent_CERT",INDICATOR.Win.RMM.PDQConnectAgent,"app.pdq.com auth.pdq.com connect.pdq.com *.ingest.sentry.io -pdqconnect.zendesk.com", -Pulseway,,,,,,,, -Anydesk,,,,,,,, +pdqconnect.zendesk.com +adminarsenal.zendesk.com +help.pdq.com", +Pulseway pcmontask,"MMSOFT Design +MMSOFT Design Ltd.",Pulseway User Agent,Pulseway User Agent,pcmontask.exe,"INDICATOR_RMM_PulseWay_PCMonTaskSrv +INDICATOR_RMM_PulseWay_CERT",INDICATOR.Win.RMM.PulseWay,computermonitor.mmsoft.ro, +Pulseway pcmonitorsrv,"MMSOFT Design +MMSOFT Design Ltd.",Pulseway,Pulseway Service,PCMonitorSrv.exe,"INDICATOR_RMM_PulseWay_PCMonTaskSrv +INDICATOR_RMM_PulseWay_CERT",INDICATOR.Win.RMM.PulseWay,computermonitor.mmsoft.ro, +Pulseway Remote Control,"MMSOFT Design +MMSOFT Design Ltd.",Pulseway Remote Control,Pulseway Remote Control,RemoteDesktop.exe,"INDICATOR_RMM_PulseWay_RemoteDesktop +INDICATOR_RMM_PulseWay_CERT",INDICATOR.Win.RMM.PulseWay,, +Anydesk,"philandro Software GmbH +AnyDesk Software GmbH",,,,,,, RemotePC,,,,,,,, Remote Utilities,,,,,,,, Kaseya,,,,,,,, @@ -75,4 +90,3 @@ PCAnywhere,,,,,,,, Xage,,,,,,,, XONA Systems,,,,,,,, Zscaler,,,,,,,, -,,,,,,,, diff --git a/clamav/clamav.ldb b/clamav/clamav.ldb index 2efba79..9f13f68 100644 --- a/clamav/clamav.ldb +++ b/clamav/clamav.ldb @@ -145,3 +145,6 @@ ditekSHen.MALWARE.Linux.Trojan.GetShell;Engine:51-255,Target:6;((0&1)|(2&3))&(4| ditekSHen.MALWARE.Win.Trojan.RookIE-Downloader;Engine:51-255,Target:1;0&1&2&3;7368656c6c3a3a3a7b32353539613166332d323164372d313164342d626461662d3030633034663630623966307d;7461736b6b696c6c202f66202f696d2068682e657865;526f6f6b49452f312e30;233332373730 ditekSHen.MALWARE.Win.Trojan.LummaStealer;Engine:51-255,Target:1;(0|1)&(3|4|5)&(6|7|8);6332736f636b::w;6332636f6e66::w;2d20436f6d70757465724e616d65446e73486f73746e616d653a;2d20436f6d70757465724e616d654e657442494f533a;2d20506879736963616c20496e7374616c6c6564204d656d6f72793a;2a2e656d6c::w;5465736c6142726f77736572::w;6c69643d2573;534f4654574152455c4d6963726f736f66745c57696e646f77735c43757272656e7456657273696f6e5c556e696e7374616c6c::w ditekSHen.MALWARE.Win.Trojan.PovertyStealer;Engine:51-255,Target:1;(0|1|2|3|4)>2;506f76657274792069732074686520706172656e74206f66206372696d65;4f7065726174696f6e53797374656d3a2025643a25643a2564;53637265656e53697a653a207b6c57696474683d25642c206c4865696768743d25647d;566964656f41646170746572202325643a202573;24642e6c6f67::w +ditekSHen.MALWARE.Win.Trojan.RDPCredsStealer-Injector;Engine:51-255,Target:1;0&(1|2|3)&(4|5|6);415049486f6f6b496e6a6563746f72;436f646520496e6a6563746564;444c4c20496e6a6563746564;5244504372656473537465616c6572444c4c;4f70656e50726f636573732829206661696c65643a;5669727475616c416c6c6f6345782829206661696c65643a;43726561746552656d6f74655468726561642829206661696c65643a +ditekSHen.INDICATOR.Win.TOOL.BURNTCIGAR;Engine:51-255,Target:1;0&1&2&3;4b696c6c20504944203d;43726561746546696c65204572726f72203d;4b696c6c4156;446576696365496f436f6e74726f6c +ditekSHen.INDICATOR.Win.TOOL.WEDGECUT;Engine:51-255,Target:1;(0&1&2)&(3|4|5)>1;49636d7053656e644563686f;49636d70436c6f736548616e646c65;49636d7043726561746546696c65;436865636b4f6e6c696e65;2d6e616d65;2d66756c6c diff --git a/clamav/indicator_rmm.ldb b/clamav/indicator_rmm.ldb new file mode 100644 index 0000000..3dd70a7 --- /dev/null +++ b/clamav/indicator_rmm.ldb @@ -0,0 +1,9 @@ +ditekSHen.INDICATOR.Win.RMM.MeshAgent;Engine:51-255,Target:1;((0|1|2|3)&(4|5|6|7)>1)|(4&5&6&7);5c4d6573684167656e74::w;4d657368204167656e74::w;4d65736844756d6d79::w;4d65736843656e7472616c::w;494c696252656d6f74654c6f6767696e672e63;4167656e74436f72652f4d6573685365727665725f::w;636f6e736f6c652e6c6f672867657453484133383446696c65486173682870726f636573732e6578656350617468292e746f537472696e672827686578272929;7b226167656e74223a22 +ditekSHen.INDICATOR.Win.RMM.ConnectWise-ScreenConnect;Engine:51-255,Target:1;(0|1|2|3|4|5)>3;46494c45535953435245454e434f4e4e4543542e434f52452c2056455253494f4e3d::w;666565646261636b2e73637265656e636f6e6e6563742e636f6d2f466565646261636b2e617864::w;53637265656e436f6e6e65637420436c69656e74::w;53637265656e436f6e6e6563742e496e7374616c6c6572416374696f6e732153637265656e436f6e6e6563742e::w;53637265656e436f6e6e6563742e436f72652e706462;5c5c2e5c506970655c5465726d696e616c5365727665725c53797374656d45786563537276725c::w +ditekSHen.INDICATOR.Win.RMM.FleetDeckAgent;Engine:51-255,Target:1;((0|1)&(2|3|4|5|6)>2)|(2&3&4&5&6);666c6565746465636b2e696f2f;6c6f616420466c6565744465636b206167656e74;72656d6f74654465736b746f7053657373696f6e4d75746578;6d61696e2e7669727475616c5465726d696e616c5761746368646f67;6d61696e2e6d65657452656d6f74654465736b746f70;7265706f2e73656e72692e73652f70726f746f74797065332f;6d61696e2e737663497063436c69656e74 +ditekSHen.INDICATOR.Win.RMM.FleetDeckCommander;Engine:51-255,Target:1;0&1&2&3;536f6674776172655c4d6963726f736f66745c466c6565744465636b20436f6d6d616e646572;7c466c6565744465636b20436f6d6d616e646572;666c6565746465636b2e696f2f70726f746f74797065332f;633a5c6167656e745c5f776f726b5c36365c735c +ditekSHen.INDICATOR.Win.RMM.FleetDeckCommander-SVC;Engine:51-255,Target:1;(0|1|2|3)>2;666c6565746465636b666f726b2f6578656366756e636172677328;666c6565746465636b2e696f2f70726f746f74797065332f636f6d6d616e6465725f737663;70726f636565643a202a2e666c6565746465636b2e696f;5245472041444420484b45595f434c41535345535f524f4f545c2573202f56202255524c2050726f746f636f6c22202f54205245475f535a202f46 +ditekSHen.INDICATOR.Win.RMM.FleetDeckCommander-Launcher;Engine:51-255,Target:1;0&1;666c6565746465636b2e696f2f70726f746f74797065332f636f6d6d616e6465725f6c61756e63686572;466c6565744465636b20436f6d6d616e646572204c61756e63686572 +ditekSHen.INDICATOR.Win.RMM.PDQConnectAgent;Engine:51-255,Target:1;((0|1|2|3|4|5|6|7|8|9|10)>4)|((11&12&13&14&15)&(0|1|2|3|4|5|6|7|8|9|10));7369676e5f7064712e7273;782d7064712d6461746543726564656e7469616c3d282e2b3f292f;7064712d636f6e6e6563742d6167656e74;50445120436f6e6e656374204167656e74;504451436f6e6e6563744167656e74;504451436f6e6e6563744167656e747372635c6c6f676765722e7273;2d5044512d4b65792d496473557365722d4167656e74;5c5044515c504451436f6e6e6563744167656e745c;5c7064715f636f6e6e6563745f6167656e742e706462;7461736b5f6964735b5d50445120726f766572;6170702e7064712e636f6d;2f646576696365732f7265676973746572;2f646576696365732f736f636b65742f776562736f636b65743f6465766963655f69643d;2f646576696365732f7461736b73;2f646576696365732f617574682d6368616c6c656e6765;2f646576696365732f72656365697665722f55726c +ditekSHen.INDICATOR.Win.RMM.PulseWay;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8)>7;4d4d2e4d6f6e69746f722e;52444167656e7453657373696f6e53657474696e677356;436865636b466f724d61634f5352656d6f74654465736b746f70557064617465436f6d706c657465644576656e74;436f6e6669726d4167656e7453746172746564;47657453637265656e73686f74;556e6c6f616452656d6f74654465736b746f70446c6c73;4374726c416c7444656c65746550726f63;2437636663336238382d366463342d343966632d396630612d626639653931313361313464;636f6d70757465726d6f6e69746f722e6d6d736f66742e726f +ditekSHen.INDICATOR.Win.RMM.PulseWay;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8)>7;4d4d2e4d6f6e69746f722e;52444167656e7453657373696f6e53657474696e677356;436865636b466f724d61634f5352656d6f74654465736b746f70557064617465436f6d706c657465644576656e74;436f6e6669726d4167656e7453746172746564;47657453637265656e73686f74;556e6c6f616452656d6f74654465736b746f70446c6c73;4374726c416c7444656c65746550726f63;2437636663336238382d366463342d343966632d396630612d626639653931313361313464;636f6d70757465726d6f6e69746f722e6d6d736f66742e726f diff --git a/yara/indicator_rmm.yar b/yara/indicator_rmm.yar index 1f02329..1fb8734 100644 --- a/yara/indicator_rmm.yar +++ b/yara/indicator_rmm.yar @@ -1,64 +1,4 @@ -rule MALWARE_Win_RDPCredsStealer { - meta: - author = "ditekSHen" - description = "Detects RDP Credentials Stealer" - clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer" - strings: - $x1 = "MyCredUnPackAuthenticationBufferW Hooked Function" ascii - $x2 = "\\RDPCredsStealerDLL\\" ascii - $x3 = "\\RDPCreds.txt" ascii - $s1 = "CredUnPackAuthenticationBufferW" ascii - $s2 = "Installing Hooked Function" ascii - $s3 = "SymLoadModule64" fullword ascii - $s4 = "memmove" fullword ascii - condition: - uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or 3 of ($s*)) -} - -rule MALWARE_Win_RDPCredsStealerInjector { - meta: - author = "ditekSHen" - description = "Detects RDP Credentials Stealer injector" - clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer-Injector" - strings: - $s1 = "\\APIHookInjectorBin\\" ascii - $s2 = "\\RDPCredsStealerDLL.dll" ascii - $s3 = "DLL Injected" ascii - $s4 = "Code Injected" ascii - $s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii - condition: - uint16(0) == 0x5a4d and 3 of them -} - -rule INDICATOR_TOOL_BURTNCIGAR { - meta: - author = "ditekSHen" - description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software" - clamav1 = "INDICATOR.Win.TOOL.BURNTCIGAR" - strings: - $s1 = "Kill PID =" ascii - $s2 = "CreateFile Error =" ascii - $s3 = "\\KillAV" ascii - $s4 = "DeviceIoControl" ascii - condition: - uint16(0) == 0x5a4d and 3 of them -} - -rule INDICATOR_TOOL_WEDGECUT { - meta: - author = "ditekSHen" - description = "Detects WEDGECUT a reconnaissance tool to checks hosts are online using ICMP packets" - clamav1 = "INDICATOR.Win.TOOL.WEDGECUT" - strings: - $s1 = "-name" fullword ascii - $s2 = "-full" fullword ascii - $s3 = "\\CheckOnline" ascii - $s4 = "IcmpSendEcho" fullword ascii - $s5 = "IcmpCloseHandle" fullword ascii - $s6 = "IcmpCreateFile" fullword ascii - condition: - uint16(0) == 0x5a4d and 4 of them -} +import "pe" rule INDICATOR_RMM_MeshAgent { meta: @@ -299,3 +239,62 @@ rule INDICATOR_RMM_PDQConnect_Agent_CERT { pe.signatures[i].subject contains "PDQ.com Corporation" ) } + +rule INDICATOR_RMM_PulseWay_PCMonTaskSrv { + meta: + author = "ditekSHen" + description = "Detects Pulseway pcmontask and service user agent responsible for Remote Control, Screens View, Computer Lock, etc" + clamav1 = "INDICATOR.Win.RMM.PulseWay" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" + strings: + $s1 = "MM.Monitor." ascii + $s2 = "RDAgentSessionSettingsV" ascii + $s3 = "CheckForMacOSRemoteDesktopUpdateCompletedEvent" ascii + $s4 = "ConfirmAgentStarted" ascii + $s5 = "GetScreenshot" ascii + $s6 = "UnloadRemoteDesktopDlls" ascii + $s7 = "CtrlAltDeleteProc" ascii + $s8 = "$7cfc3b88-6dc4-49fc-9f0a-bf9e9113a14d" ascii + $s9 = "computermonitor.mmsoft.ro" ascii + condition: + (uint16(0) == 0x5a4d or uint16(0) == 0xcfd0) and 7 of them +} + +rule INDICATOR_RMM_PulseWay_RemoteDesktop { + meta: + author = "ditekSHen" + description = "Detects Pulseway Rempte Desktop client" + clamav1 = "INDICATOR.Win.RMM.PulseWay" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" + strings: + $s1 = "RemoteControl" ascii + $s2 = "MM.Monitor.RemoteDesktopClient." ascii + $s3 = "MM.Monitor.RemoteControl" ascii + $s4 = "RemoteDesktopClientUpdateInfo" ascii + $s5 = "ShowRemoteDesktopEnabledSystemsOnly" ascii + $s6 = "$31f50968-d45c-49d6-ace9-ebc790855a51" ascii + condition: + (uint16(0) == 0x5a4d or uint16(0) == 0xcfd0) and 5 of them +} + +rule INDICATOR_RMM_PulseWay_CERT { + meta: + author = "ditekSHen" + description = "Detects PulseWay by (default) certificate. Review RMM Inventory" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" + condition: + uint16(0) == 0x5a4d and + for any i in (0..pe.number_of_signatures): ( + pe.signatures[i].issuer contains "DigiCert, Inc." and + pe.signatures[i].subject contains "MMSOFT Design Ltd." + ) +}