Emulating the Southeast Asian Adversary OceanLotus – AttackIQ

MITRE Techniques

• [T1055] Process Injection – Injects a DLL into another process and validates canary file creation (‘injects a DLL file into another running process and validates if a canary file can be created.’)
• [T1046] Network Service Discovery – Scans for hosts on ports 21, 139, 389, 445, and 3389 using nmap (‘scanning hosts that are open on ports 21, 139, 389, 445, and 3389’).
• [T1110.003] Brute Force: Password Spraying – Brute-forces FTP and SMB protocols to obtain valid credentials (‘brute-forcing FTP (21) and SMB (445) protocols’).
• [T1082] System Information Discovery – Executes Get-ComputerInfo (PowerShell) and uname to collect host information (‘executes the Get-ComputerInfo cmdlet via PowerShell’ / ‘executes uname -rms’).
• [T1049] System Network Connections Discovery – Uses Get-NetDomain and netstat to enumerate domain and active network connections (‘executes the Get-NetDomain PowerView cmdlet’ / ‘uses netstat to collect active connections’).
• [T1083] File and Directory Discovery – Uses dir to find files of interest and outputs to temporary files (‘uses the native dir command to find files of interest and output to a temporary file.’)
• [T1518] Software Discovery – Lists installed applications and versions using PowerShell (‘will list all the applications installed, as well as their versions using a PowerShell Script.’)
• [T1518.001] Security Software Discovery – Queries AntiVirusProduct class via PowerShell to detect security software (‘a PowerShell script is executed to determine which software has been installed as an AntiVirusProduct class.’)
• [T1033] System Owner/User Discovery – Calls GetUserNameW API to retrieve the current thread user (‘will call the GetUserNameW Windows API call to retrieve the name of the user associated with the current thread.’)
• [T1016] System Network Configuration Discovery – Collects network config via ipconfig/arp/route/nltest and Unix equivalents (‘using standard Windows utilities like ipconfig, arp, route, and nltest’ / ‘netstat, route, ifconfig, and arp –a’).
• [T1120] Peripheral Device Discovery – Executes Get-Disk (PowerShell) to gather disk/partition info (‘executes the PowerShell cmdlet Get-Disk to gather valuable information about the physical drives and partitions’).
• [T1057] Process Discovery – Uses CreateToolhelp32Snapshot and Process32FirstW/Process32NextW to enumerate running processes (‘Windows API is used to receive a list of running processes by calling CreateToolhelp32Snapshot and iterating through each process object’).
• [T1007] System Service Discovery – Runs Get-Service via PowerShell to enumerate services (‘executes the PowerShell cmdlet Get-Service to gather valuable information about installed services and applications’).
• [T1041] Exfiltration Over C2 Channel – Sends files to attacker server using HTTP POST requests (‘Files are sent to an AttackIQ controlled server using HTTP POST requests.’)
• [T1105] Ingress Tool Transfer – Downloads payloads to memory and saves to disk to exercise delivery controls (‘downloads to memory and saves to disk in two separate scenarios’).
• [T1543.003] Windows Service – Creates a persistent service using sc to run payloads at reboot (‘Use the native sc command line tool to create a new service that will be executed at reboot.’)
• [T1053.005] Scheduled Task/Job: Scheduled Task – Creates scheduled tasks with schtasks for persistence (‘creates a new scheduled task using the schtasks utility.’)
• [T1134.001] Access Token Manipulation: Token Impersonation/Theft – Uses named pipe impersonation leveraged by Cobalt Strike for privilege escalation (‘uses the named pipe impersonation method leveraged by Cobalt Strike to escalate privileges.’)
• [T1003] OS Credential Dumping – Uses obfuscated Mimikatz to dump password hashes (‘uses an obfuscated version of Mimikatz to dump passwords and hashes for Windows accounts.’)
• [T1047] Windows Management Instrumentation – Moves laterally using WMI calls (‘attempt to move laterally to any available asset inside the network through the use of Windows Management Instrumentation (WMI).’)
• [T1127.001] Trusted Developer Utilities Proxy Execution: MSBuild – Executes Cobalt Strike via MSBuild to run arbitrary code (‘Cobalt Strike will be deployed and executed via MSBuild on the compromised system.’)
• [T1071.001] Application Layer Protocol: Web Protocols – Uses HTTP for C2 and exfiltration (’emulates the HTTP requests made by OceanLotus by making an HTTP request to an AttackIQ server.’)
• [T1217] Browser Information Discovery – Enumerates browser bookmarks via PowerShell to gather user/host info (‘uses a PowerShell script to enumerate browser bookmarks’).
• [T1136.001] Create Account: Local Account – Creates local accounts using net user for persistence (’emulates the creation of a new account using net user.’)
• [T1548.002] Bypass User Account Control – Disables UAC by setting registry keys (‘attempts to disable UAC by setting a registry key.’)