Campaign against Russian Opposition

Name:
Campaign against Russian Opposition

TTP:
T1583.001 Acquire Infrastructure: Domains, T1071.001 Application Layer Protocol: Web Protocols, T1059.001 Command and Scripting Interpreter: PowerShell, T1140 Deobfuscate/Decode Files or Information, T1041 Exfiltration Over C2 Channel, T1105 Ingress Tool Transfer, T1036 Masquerading, T1027 Obfuscated Files or Information, T1566.001 Phishing: Spearphishing Attachment, T1204.002 User Execution: Malicious File

Hypothesis:

The attacker may use phishing emails with malicious attachments to deliver and execute a malicious tool, such as a reverse shell, on the victim’s machine. The tool will likely use web protocols to communicate with the attacker’s C2 server.

Campaign Type:
Intel Driven

Data Sources:

• Email logs (to identify phishing emails)
• Endpoint logs (to detect the execution of malicious files and PowerShell scripts)
• Network traffic logs (to find communication with the attacker’s C2 server)

Tools:

Powershell

CobaltStrike 4 post Exploitation

Scenario:

1. Initial Access: The attacker sends a spear-phishing email with a malicious attachment (e.g., a ZIP file containing an LNK file) to the victim.
2. Execution: The victim opens the attachment, which executes a PowerShell script.
3. Defense Evasion: The PowerShell script may use obfuscation techniques to avoid detection.
4. Ingress Tool Transfer: The script downloads and executes a malicious tool, such as HTTP-Shell.
5. Command and Control: The tool communicates with the attacker’s C2 server using web protocols.
6. Exfiltration: The attacker may use the C2 channel to exfiltrate data from the victim’s machine.

Hunting Strategy:

1. Analyze email logs for suspicious emails with attachments.
2. Correlate email events with endpoint logs to see if any attachments were executed.
3. Look for the execution of PowerShell scripts with obfuscated code.
4. Analyze network traffic logs for any communication with suspicious domains or IP addresses.
5. Investigate any outliers or anomalies in the data.
6. Validate potential threats by analyzing the code and behavior of suspicious processes.
7. Remediate by isolating infected machines and removing the malicious tools and scripts.
8. Report findings and recommendations to improve security controls and prevent future attacks.

False Positive Consideration:

• Legitimate PowerShell scripts used by system administrators or other users.
• Normal network traffic to legitimate websites that may be misidentified as C2 communication.

D3 Diagram: