From cd99e732c8f3cc13faf048d52c3ef5faa9fd761e Mon Sep 17 00:00:00 2001 From: ditekshen Date: Fri, 4 Oct 2024 09:44:02 +0300 Subject: [PATCH] Update indicator_rmm --- clamav/indicator_rmm.ldb | 5 ++++ yara/indicator_rmm.yar | 55 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/clamav/indicator_rmm.ldb b/clamav/indicator_rmm.ldb index 54590d7..76951f1 100644 --- a/clamav/indicator_rmm.ldb +++ b/clamav/indicator_rmm.ldb @@ -11,3 +11,8 @@ ditekSHen.INDICATOR.Win.RMM.ManageEngine-ZohoMeeting;Engine:51-255,Target:1;0&1& ditekSHen.INDICATOR.Win.RMM.Atera;Engine:51-255,Target:1;(0&1&2&3&4)>2;534f4654574152455c4154455241204e6574776f726b735c416c7068614167656e74::w;416c706861436f6e74726f6c4167656e745c6f626a5c52656c656173655c41746572614167656e742e706462;416c706861436f6e74726f6c4167656e742e436c6f75644c6f67734d616e616765722b3c3e;4d6f6e69746f72696e672026204d616e6167656d656e74204167656e74206279204154455241::aw;6167656e742d6170692d7b307d2e61746572612e636f6d::w ditekSHen.INDICATOR.Win.RMM.SplashtopStreamer;Engine:51-255,Target:1;(0&1&2&3&4&5)>3;5c736c6176655c776f726b73706163655c4749545f57494e5f5352535f466f726d616c5c536f757263655c697269737365727665725c;536f6674776172655c53706c617368746f7020496e632e5c53706c617368746f70::w;2e6170692e73706c617368746f702e636f6d::w;726573746172746564207468652073747265616d65722e256e4170702076657273696f6e3a202531::w;53706c617368746f702d53706c617368746f702053747265616d65722d::w;5b52656d6f766553747265616d65725d2053656e64206d7367203220636c6f75642825643a25643a256429::w ditekSHen.INDICATOR.Win.RMM.AeroAdmin;Engine:51-255,Target:1;(0&1&2&3&4&5&6)>3;5c4165726f41646d696e::w;2e6165726f61646d696e2e636f6d::w;584165726f61646d696e417070526573746172746572::w;5c4e6574776f726b5c4165726f61646d696e53657276696365::w;4165726f41646d696e207b7d;464165726f41646d696e2e637070;504f5354202f73696d732f73696d735f6e65772e706870 +ditekSHen.INDICATOR.Win.RMM.DWAgent-SoundCapture;Engine:51-255,Target:1;0&1;445741536f756e6443617074757265;5f5a367265636f72645076535f +ditekSHen.INDICATOR.Win.RMM.DWAgent-ScreenCapture;Engine:51-255,Target:1;0&1&2;44574167656e744c6962::w;53637265656e436170747572653a3a;64776173637265656e63617074757265 +ditekSHen.INDICATOR.Win.RMM.DWAgent-LIB;Engine:51-255,Target:1;(0)&(1&2&3&4&5)>2;44574167656e744c6962::w;69735461736b52756e6e696e67;697355736572496e41646d696e47726f7570;73657446696c655065726d697373696f6e45766572796f6e65;737461727450726f63657373496e416374697665436f6e736f6c65;7461736b4b696c6c +ditekSHen.INDICATOR.Win.RMM.DWAgent-SVC;Engine:51-255,Target:1;0&1&2;5c6e61746976655c64776167::w;4372656174655365727669636557;64776167656e742e::w +ditekSHen.INDICATOR.Osx.RMM.DWAgent-RUN;Engine:51-255,Target:9;0&1&2;6e65742e6477736572766963652e44574167656e74;2d5b44574144656c6567617465;637573746f6d57696e646f7773546f456e74657246756c6c53637265656e466f7257696e646f773a6f6e53637265656e3a diff --git a/yara/indicator_rmm.yar b/yara/indicator_rmm.yar index b6681bb..53cd032 100644 --- a/yara/indicator_rmm.yar +++ b/yara/indicator_rmm.yar @@ -464,6 +464,11 @@ rule INDICATOR_RMM_DWAgentLIB { meta: author = "ditekSHen" description = "Detect DWAgent Remote Administration Tool library" + clamav1 = "INDICATOR.Win.RMM.DWAgent-LIB" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" strings: $s1 = "DWAgentLib" fullword wide $s2 = "PYTHONHOME" fullword wide @@ -480,6 +485,11 @@ rule INDICATOR_RMM_DWAgentSVC { meta: author = "ditekSHen" description = "Detect DWAgent Remote Administration Tool service" + clamav1 = "INDICATOR.Win.RMM.DWAgent-SVC" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" strings: $s1 = "\\native\\dwagupd.dll" wide $s2 = "\\native\\dwagsvc.exe\" run" wide @@ -494,6 +504,11 @@ rule INDICATOR_RMM_DWAgent_ScreenCapture { meta: author = "ditekSHen" description = "Detect DWAgent Remote Administration Tool Screen Capture Module" + clamav1 = "INDICATOR.Win.RMM.DWAgent-ScreenCapture" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" strings: $s1 = "DWAgentLib" fullword wide $s2 = "PYTHONHOME" wide @@ -516,6 +531,11 @@ rule INDICATOR_RMM_DWAgent_SoundCapture { meta: author = "ditekSHen" description = "Detect DWAgent Remote Administration Tool Sound Capture Module" + clamav1 = "INDICATOR.Win.RMM.DWAgent-SoundCapture" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" strings: $s1 = "DWASoundCapture" ascii $s2 = /_Z\d{2}DWASoundCapture/ ascii @@ -523,3 +543,38 @@ rule INDICATOR_RMM_DWAgent_SoundCapture { condition: uint16(0) == 0x5a4d and all of them } + +rule INDICATOR_RMM_DWAgent_CERT { + meta: + author = "ditekSHen" + description = "Detects DWAgent by certificate. Review RMM Inventory" + thumbprint = "4a13f46def2c9427898a46a88a6a2122ed106b37" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" + condition: + uint16(0) == 0x5a4d and + for any i in (0..pe.number_of_signatures): ( + pe.signatures[i].subject contains "DWSNET srl" and + pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and + pe.signatures[i].serial == "00:af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53" + ) +} + +rule INDICATOR_OSX_RMM_DWAgent { + meta: + author = "ditekSHen" + description = "Detect DWAgent Remote Administration Tool macOS run" + clamav1 = "INDICATOR.Osx.RMM.DWAgent-RUN" + reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv" + reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a" + reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" + reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf" + strings: + $s1 = "net.dwservice.DWAgent" ascii + $s2 = "-[DWADelegate" ascii + $s3 = "customWindowsToEnterFullScreenForWindow:onScreen:" ascii + condition: + uint16(0) == 0xfeca and all of them +}