Covenant Remote WMI Eventing ActiveScriptEventConsumers¶

Metadata¶


Author	Roberto Rodriguez @Cyb3rWard0g
Creation Date	2020/07/24
Modification Date	2020/07/24
Tactics	[‘TA0002’, ‘TA0008’]
Techniques	[‘T1047’]
Tags	[‘Remote WMI Eventing’]

Dataset Description¶

This dataset represents adversaries using WMI event subscriptions (ActiveScriptEventConsumers) remotely to move laterally.

Datasets Downloads¶

Dataset Type	Link
Host	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/covenant_wmi_remote_event_subscription_ActiveScriptEventConsumers.zip
Network	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/network/covenant_wmi_remote_event_subscription_ActiveScriptEventConsumers.zip

Notebooks¶

Notebooks created by the community leveraging the mordor datasets

Author	Name	Link

Simulation Plan¶

Environment	Tool Type	Module
Mordor shire	manual	manual

Adversary View¶

Explore Mordor Dataset¶

Initialize Analytics Engine¶

from openhunt.mordorutils import *
spark = get_spark()

Download & Process Mordor File¶

mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/covenant_wmi_remote_event_subscription_ActiveScriptEventConsumers.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")

[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable 

Get to know your data¶

df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)

+---------------------------+------------------------------------+-------+-----+
|Hostname                   |Channel                             |EventID|count|
+---------------------------+------------------------------------+-------+-----+
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|10     |2009 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|7      |165  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|12     |164  |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|7      |146  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|10     |94   |
|WORKSTATION5.theshire.local|Security                            |5156   |77   |
|WORKSTATION6.theshire.local|Security                            |4703   |74   |
|WORKSTATION6.theshire.local|Security                            |5156   |71   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|12     |65   |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|13     |62   |
|WORKSTATION5.theshire.local|Security                            |4658   |52   |
|MORDORDC.theshire.local    |Security                            |5156   |51   |
|WORKSTATION5.theshire.local|Security                            |5158   |48   |
|WORKSTATION6.theshire.local|Security                            |4658   |45   |
|MORDORDC.theshire.local    |Security                            |5158   |41   |
|MORDORDC.theshire.local    |Microsoft-Windows-Sysmon/Operational|12     |36   |
|MORDORDC.theshire.local    |Microsoft-Windows-Sysmon/Operational|7      |32   |
|WORKSTATION6.theshire.local|Security                            |5158   |30   |
|MORDORDC.theshire.local    |Microsoft-Windows-Sysmon/Operational|3      |28   |
|WORKSTATION5.theshire.local|Security                            |4656   |27   |
+---------------------------+------------------------------------+-------+-----+
only showing top 20 rows

Empire Invoke DCOM ShellWindows Empire Invoke PsExec