Estimated reading time: 6 minutes
On December 8th 2020, FireEye disclosed that it was the target of a successful, highly sophisticated state-sponsored cyber attack. Many of the Red Team tools have already been released to the community and are already distributed in FireEye’s open-source virtual machine, CommandoVM.
FireEye has published countermeasures on GitHub in an effort to help organizations identify and mitigate the use of the stolen tools through the use of Yara, Snort, and other rule sets. The repository references more than 300 countermeasures rules compatible with Snort, Yara, ClamAV, HXIOC.
IBM can also help you extend that monitoring using QRadar. You’ll find below some guidance, sorted by ease of implementation (of course relative to each environment) from the easiest/fastest to the most advanced, as well as the resources associated to each method:
- DSM Updates
- Snort Rules
- MD5, SHA-1 and SHA-256
- Endpoint content extension
DSM updates
By default, QRadar will include many detection thanks to the mapping of the events.
Below is the list of devices that handle the CVE listed in the GitHub repository and are mapped in QRadar.
| CVE |
Device Type
|
QID
|
Event Name
|
|
CVE-2020-1472
|
Symantec Endpoint Protection
|
42009366
|
OS Attack: Microsoft Netlogon CVE-2020-1472 3
|
|
CVE-2020-1472
|
Symantec Endpoint Protection
|
42009411
|
OS Attack: Microsoft Netlogon CVE-2020-1472 4
|
|
CVE-2020-1472
|
Snort Open Source IDS
|
2623098
|
ET EXPLOIT Possible Zerologon NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)
|
|
CVE-2020-1472
|
Snort Open Source IDS
|
2623099
|
ET EXPLOIT Possible Zerologon NetrServerAuthenticate with 0x00 Client Credentials (CVE-2020-1472)
|
|
CVE-2020-1472
|
Juniper Networks Intrusion Detection and Prevention (IDP)
|
6273151
|
MS-RPC:NTLGON-CVE-2020-1472-EOP
|
|
CVE-2020-1472
|
Symantec Endpoint Protection
|
42009336
|
OS Attack: Microsoft Netlogon CVE-2020-1472
|
|
CVE-2020-1472
|
McAfee Network Security Platform
|
8264218
|
DCERPC: Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472)
|
|
CVE-2020-1472
|
Snort Open Source IDS
|
2623646
|
ET EXPLOIT [401TRG] Possible Zerologon (CVE-2020-1472) UUID flowbit set
|
|
CVE-2020-1472
|
Snort Open Source IDS
|
2623647
|
ET EXPLOIT [401TRG] Possible Zerologon (CVE-2020-1472) M2
|
|
CVE-2020-1472
|
Symantec Endpoint Protection
|
42009354
|
OS Attack: Microsoft Netlogon CVE-2020-1472 2
|
|
CVE-2018-13379
|
Snort Open Source IDS
|
2615902
|
ET EXPLOIT FortiOS SSL VPN - Information Disclosure (CVE-2018-13379)
|
|
CVE-2018-13379
|
Symantec Endpoint Protection
|
42008498
|
Web Attack: Fortinet FortiOS Directory Traversal CVE-2018-13379
|
|
CVE-2018-13379
|
McAfee Network Security Platform
|
8263716
|
HTTP: FortiOS SSL VPN Arbitrary File Read Vulnerability (CVE-2018-13379)
|
|
CVE-2018-15961
|
Snort Open Source IDS
|
2611023
|
ET WEB_CLIENT [Volex] Possible ColdFusion Unauthenticated Upload Attempt (CVE-2018-15961)
|
|
CVE-2018-15961
|
McAfee Network Security Platform
|
8263991
|
HTTP: Adobe ColdFusion File Upload Vulnerability (CVE-2018-15961)
|
|
CVE-2019-0604
|
Snort Open Source IDS
|
2615360
|
ET WEB_SPECIFIC_APPS Possible SharePoint RCE Attempt (CVE-2019-0604)
|
|
CVE-2019-0604
|
Juniper Networks Intrusion Detection and Prevention (IDP)
|
6271499
|
HTTP:EXPLOIT:CVE-2019-0604-RCE1
|
|
CVE-2019-0604
|
Juniper Networks Intrusion Detection and Prevention (IDP)
|
6271500
|
HTTP:EXPLOIT:CVE-2019-0604-RCE2
|
|
CVE-2019-0604
|
McAfee Network Security Platform
|
8263304
|
HTTP: Microsoft SharePoint Remote Code Execution (CVE-2019-0604)
|
|
CVE-2019-0604
|
Symantec Endpoint Protection
|
42008296
|
Web Attack: Microsoft SharePoint RCE CVE-2019-0604
|
|
CVE-2019-0708
|
Snort Open Source IDS
|
2615386
|
ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)
|
|
CVE-2019-0708
|
Stonesoft Management Center
|
64761227
|
Generic_CS-Windows-RDP-CVE-2019-0708
|
|
CVE-2019-0708
|
Symantec Endpoint Protection
|
42008293
|
OS Attack: Microsoft Windows Remote Desktop Services RCE CVE-2019-0708
|
|
CVE-2019-0708
|
Symantec Endpoint Protection
|
42008294
|
OS Attack: Microsoft Windows Remote Desktop Services RCE CVE-2019-0708 2
|
|
CVE-2019-0708
|
Juniper Networks Intrusion Detection and Prevention (IDP)
|
6271581
|
APP:REMOTE:CVE-2019-0708-CE
|
|
CVE-2019-0708
|
Symantec Endpoint Protection
|
42008563
|
OS Attack: Microsoft Windows Remote Desktop Services RCE CVE-2019-0708 3
|
|
CVE-2019-11580
|
Snort Open Source IDS
|
2615735
|
ET WEB_SPECIFIC_APPS Atlassian Crowd Plugin Upload Attempt (CVE-2019-11580)
|
|
CVE-2019-11580
|
McAfee Network Security Platform
|
8264249
|
HTTP: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability (CVE-2019-11580)
|
|
CVE-2019-19781
|
Snort Open Source IDS
|
2618461
|
ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781)
|
|
CVE-2019-19781
|
Symantec Endpoint Protection
|
42008728
|
Web Attack: Citrix ADC RCE CVE-2019-19781
|
|
CVE-2019-19781
|
Snort Open Source IDS
|
2619423
|
ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781) M2
|
|
CVE-2019-19781
|
McAfee Network Security Platform
|
8263684
|
HTTP: Citrix ADC Arbitrary Code Execution Vulnerability (CVE-2019-19781)
|
|
CVE-2020-10189
|
Symantec Endpoint Protection
|
42008877
|
Attack: Zoho ManageEngine Desktop Central CVE-2020-10189
|
|
CVE-2020-10189
|
Snort Open Source IDS
|
2620468
|
ET EXPLOIT Zoho ManageEngine Desktop Central RCE Inbound (CVE-2020-10189)
|
|
CVE-2019-3398
|
McAfee Network Security Platform
|
8263992
|
HTTP: Atlassian Confluence Server and Data Center Directory Traversal Vulnerability (CVE-2019-3398)
|
|
CVE-2020-0688
|
Snort Open Source IDS
|
2620186
|
ET WEB_SPECIFIC_APPS Possible Attempted Microsoft Exchange RCE (CVE-2020-0688)
|
|
CVE-2020-0688
|
Symantec Endpoint Protection
|
42008836
|
Web Attack: Microsoft Exchange Remote Code Execution CVE-2020-0688
|
|
CVE-2020-0688
|
McAfee Network Security Platform
|
8263777
|
HTTP: Microsoft Exchange Server Memory Corruption Vulnerability (CVE-2020-0688)
|
|
CVE-2016-0167
|
McAfee Network Security Platform
|
8260232
|
HTTP: Microsoft Win32k Elevation of Privilege Vulnerability (CVE-2016-0167)
|
|
CVE-2017-11774
|
Symantec Endpoint Protection
|
42008397
|
Web Attack: Microsoft Office Outlook CVE-2017-11774
|
|
CVE-2017-11774
|
Juniper Networks Intrusion Detection and Prevention (IDP)
|
6272196
|
HTTP:STC:OUTLOOK:CVE-2017-11774
|
|
CVE-2017-11774
|
McAfee Network Security Platform
|
8263431
|
HTTP: Microsoft Outlook Security Feature Bypass Vulnerability (CVE-2017-11774)
|
|
CVE-2018-8581
|
McAfee Network Security Platform
|
8263128
|
HTTP: Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2018-8581)
|
|
CVE-2018-8581
|
Juniper Networks Intrusion Detection and Prevention (IDP)
|
6272775
|
HTTP:CVE-2018-8581-PE
|
|
CVE-2019-8394
|
McAfee Network Security Platform
|
8263990
|
HTTP: Zoho ManageEngine ServiceDesk Plus Upload Arbitrary Files Vulnerability (CVE-2019-8394)
|
Snort rules
These rules are probably the fastest to implement. Once you have ensured your Snort device accounts for the right signatures, the QRadar part is only 2 steps:
Apply Red Team Countermeasures - Snort Rules on events which are detected by the Local system
and when the event(s) were detected by one or more of Snort Open Source IDS
and when the event matches "Rule ID" in (25894, 25893, 25874, 25881, 25879, 25848, 25887, 25873, 33355045, 25890, 25892, 25878, 25891, 25857, 25880, 25885, 25900, 62010239, 25886, 25875, 25889, 25877, 25888, 25884, 25902, 25866, 25899, 25882, 25876, 25901, 25849, 100001, 25850) AQL filter query |
Custom Property Rule ID
MD5, SHA-1 and SHA-256
Another quick hit would be to enable detection with MD5, SHA-1 and SHA-256. Here, the proposal is to create 3 reference sets and 1 custom rule.
- Create three Reference Sets, one per hash type and populate them with the FireEye_RedTeamTools_md5, FireEye_RedTeamTools_sha1, FireEye_RedTeamTools_sha256 files (comma separated) using the same procedure as described before.
-
Install content extensions containing Hash properties or create your own.
On the App Exchange, you can find MD5, SHA-1 and SHA-256 parsed for the following devices:
Carbon Black Response, Cisco AMP, McAfee ePolicy Orchestrator, Microsoft Windows Defender ATP, Microsoft Windows Security Event Log
- Create a rule that tests the Custom Properties MD5 Hash, Parent MD5, SHA1 Hash, Parent SHA1 Hash, SHA256 Hash, Parent SHA256 Hash against the new Reference Sets.
Apply Red Team Countermeasures - Tools Hash on events which are detected by the Local system
and when the event(s) were detected by one or more of Carbon Black Response, Cisco AMP, McAfee ePolicy Orchestrator, Microsoft Windows Defender ATP, Microsoft Windows Security Event Log
and when the event matches ("MD5 Hash" IS NOT NULL AND REFERENCESETCONTAINS('FireEye Red Team Countermeasures - MD5', "MD5 Hash")) OR ("Parent MD5" IS NOT NULL AND REFERENCESETCONTAINS('FireEye Red Team Countermeasures - MD5', "Parent MD5")) OR ("SHA1 Hash" IS NOT NULL AND REFERENCESETCONTAINS('FireEye Red Team Countermeasures - SHA1', "SHA1 Hash")) OR ("Parent SHA1 Hash" IS NOT NULL AND REFERENCESETCONTAINS('FireEye Red Team Countermeasures - MD5', "Parent SHA1 Hash")) OR ("SHA256 Hash" IS NOT NULL AND REFERENCESETCONTAINS('FireEye Red Team Countermeasures - SHA256', "SHA256 Hash")) OR ("Parent SHA256 Hash" IS NOT NULL AND REFERENCESETCONTAINS('FireEye Red Team Countermeasures - SHA256', "Parent SHA256 Hash")) AQL filter query |
Endpoint content extension
If you have read the Endpoint blog published a few weeks ago, you probably remember that the first topic was about tools used by both Red Teams and Malware.
We implemented some rules specific to known tools (Cobalt Strike, SharpHound, PingCastle, Advanced IP Scanner, AdFind, Everything and Masscan) as well as more general ones.
As mentioned in their blog, “The Red Team tools stolen by the attacker did not contain zero-day exploits. The tools apply well-known and documented methods that are used by other red teams around the world.”. The Endpoint Content Extension, associated with the Windows CEP and the Linux CEP, provides a solid base that can be reused (completely or duplicated for tuning) to extend the detection to FireEye specific tools.
Here is the list of rules that require focus for behaviour and IOC related to attack paths reconnaissance tools:
- Cobalt Strike Behaviour Detected
- Excessive Nslookup Usage
- Excessive Failed Access to an Administrative Share from the Same Source
- Reconnaissance Tool Detected
- SharpHound PowerShell Detected
- BB:BehaviorDefinition: Cobalt Strike Process Address
- BB:BehaviorDefinition: Cobalt Strike Port Usage
- BB:BehaviorDefinition: Cobalt Strike Outbound Traffic
- BB:BehaviorDefinition: Cobalt Strike Inbound Traffic
- BB:BehaviorDefinition: Repeated Nslookup Usage
- BB:BehaviorDefinition: Hostname or Network Discovery
We also have a few rules focusing on credential dumping, scans, protocol flaws, etc
- Credential Dumping Activities Discovered
- Excessive Login Failures via RDP
- Excessive Login Failures via RDP to Multiple Machines
- RDP Hijacking Tool Detected
- Search for Password Files using findstr (Windows)
- Search for Password Files using Select-String (Windows)
- Search for Password Files using grep or find (Unix)
- BB:BehaviorDefinition: Group or Account Discovery
- BB:BehaviorDefinition: Password Policy Discovery (Unix)
- BB:BehaviorDefinition: Password Policy Discovery (Windows)
The installation and configuration related to the Endpoint content extension requires a little more work as it potentially involves the configuration of the Endpoints to send relevant logs to QRadar.
The procedure is described in the QRadar configuration section of the Endpoint blog
Conclusion
These are examples of measures you can implement fairly quickly, many other possibilities are left available to you. You can extend the detection to all your devices compatible with YARA such as Crowdstrike, Bluecoat, Symantec, Websense, etc. and centralize the correlation and alerting on QRadar (refer to all-yara.yar on GitHub).
In conclusion, a security incident of this magnitude and the media coverage that follows may leave you feeling overwhelmed, but continuous updates and the latest security research can help you deal with the situation. Many solutions exist, each step little better than the previous one.
If you are interested in reading more about QRadar Security Content, you can find the complete list of blog entries here.
#Highlights
#Highlights-home
#QRadar