Upgrade to Pro — share decks privately, control downloads, hide ads and more …

N-IOCs to Rule Them All

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →

N-IOCs to Rule Them All

The Swiss GovCERT published monthly statistics on the most common malware families in Switzerland. Much of the published analysis on these malware families focused on the malware’s reverse engineering rather than the forensic artifacts that a successful infection leaves on a host.In our research, we examined the top malware families from a forensic perspective to find commonalities in infection, data collection, and network transmission. Through the data obtained through our research, we were able to identify targeted IOC (Indicators of Compromise) that can be used for all malware families (for example, run keys, executables in the AppData folder, specific event logs). This abstraction or generalization of malware families allows SOC analysts, incident responders, and threat hunters to search for malicious behavior on the network more precisely and quickly without focusing on just one malware family.

Avatar for Stephan Berger

Stephan Berger

May 05, 2023

Other Decks in Technology

Transcript

  1. ABOUT ME (STEPHAN BERGER) 2 Head of Investigations at InfoGuard

    AG • Spending probably too much time on • Luckily I have an excellent team covering my back • Master of musical song references • SysAdmin / SOC-Analyst / CSIRT / Consultant
  2. TOP 10 MALWARE FAMILIES (GOVCERT.CH) 5 • Nanocore RAT •

    Ave Maria RAT • Agent Tesla • QakBot • Redline Stealer • Remcos • Loki Password Stealer • 404 Keylogger • Formbook • Netwire RAT Source: April 2022 – December 2022
  3. IOC #2: POWERSHELL 12 AT FB 404 LPS AM RC

    NCR QB RLS NWR ( ) ( ) AT FB 404 LPS AM RC NCR QB RLS NWR ( ) ( ) ( ) ( )
  4. ARTIFACTS: EVENT LOGS 19 SECURITY.EVTX • 4698: A scheduled task

    was created • 4699: A scheduled task was deleted • 4700: A scheduled task was enabled • 4701: A scheduled task was disabled • 4702: A scheduled task was updated MICROSOFT-WINDOWS-TASKSCHEDULER%4OPERATIONAL.EVTX • 140: User <user> updated Task Scheduler task <task_name> • 141: User <user> deleted Task Scheduler task <task_name>
  5. ARTIFACTS: FIREWALL LOGS 35 MIGHT BE NOISY! BETTER FILTER ON

    THE IMAGE (SYSMON EVENT ID 3) 404 Keylogger sample below