Skip to content

Komodo - #2358

Merged
patel-bhavin merged 44 commits into
developfrom
komodo
Sep 16, 2022
Merged

Komodo#2358
patel-bhavin merged 44 commits into
developfrom
komodo

Conversation

@MHaggis

@MHaggis MHaggis commented Sep 1, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

New Analytic Story

  • CISA AA22-257A

New Analytics

  • Windows System Binary Proxy Execution Compiled HTML File Decompile
  • Windows Event Triggered Image File Execution Options Injection
  • Windows Protocol Tunneling with Plink

New SSA Analytics

  • Windows OS Credential Dumping with Ntdsutil Export NTDS (Passed)
  • Windows OS Credential Dumping with Procdump (Passed)
  • Windows System Binary Proxy Execution MSIExec DLLRegisterServer (Passed)
  • Windows System Binary Proxy Execution MSIExec Remote Download (Passed)
  • Windows System Binary Proxy Execution MSIExec Unregister DLL (Passed)
  • Windows System Binary Proxy Execution Compiled HTML File Decompile (Passed)
  • Windows System Binary Proxy Execution Compiled HTML File URL In Command Line (Passed)
  • Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers (Passed)
  • Windows Ingress Tool Transfer Using Explorer (Passed)
  • Windows Odbcconf Load Response File (Passed)
  • Windows Execute Arbitrary Commands with MSDT (Passed)

Updated:

  • Windows Ingress Tool Transfer Using Explorer
  • Windows LOLBin Binary in Non Standard Path
  • Dump LSASS via procdump
  • Windows Identify Protocol Handlers

Screencap

HH
image

Plink
image

@MHaggis MHaggis added WIP DO NOT MERGE Work in Progress 3.49.0 labels Sep 2, 2022
tccontre
tccontre previously approved these changes Sep 5, 2022
View reviewed changes

@tccontre tccontre left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ljstella ljstella added the BA label Sep 8, 2022
@ljstella

ljstella commented Sep 8, 2022

Copy link
Copy Markdown
Contributor

  • ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
    PASSED, 8 anomalies in 8 events

  • ssa___windows_os_credential_dumping_with_procdump.yml
    PASSED, 6 anomalies in 10 events

  • ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
    PASSED, 3 anomalies in 5 events

  • ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
    PASSED, 1 anomaly in 22 events

  • ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
    PASSED, 3 anomalies in 22 events

  • ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
    PASSED, 1 anomaly in 33 events

  • ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
    PASSED, 1 anomaly in 33 events

  • ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
    PASSED, 1 anomaly in 33 events

@MHaggis MHaggis removed the WIP DO NOT MERGE Work in Progress label Sep 12, 2022
@MHaggis MHaggis added the WIP DO NOT MERGE Work in Progress label Sep 15, 2022
@MHaggis MHaggis removed the WIP DO NOT MERGE Work in Progress label Sep 16, 2022
@patel-bhavin
patel-bhavin merged commit e09003d into develop Sep 16, 2022
@delete-merged-branch
delete-merged-branch Bot deleted the komodo branch September 16, 2022 19:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@patel-bhavin patel-bhavin patel-bhavin approved these changes
@tccontre tccontre tccontre left review comments

Assignees

No one assigned

Labels

BA

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@MHaggis @ljstella @patel-bhavin @tccontre @pyth0n1c