Additional Info:
Date of Investigation: Aug, 29, 2024, 11:15 PM
Alert Title: Meterpreter or Empire activity detected
Time to investigate: 42 Minutes<\/p>\n\n\n\n
Retrospective Note:
If I were to revisit this today, I’d use more accurate wording on the specific tool being used. For example, instead of “Checking the endpoint”, I would say “After checking the endpoint security tool\/module…”, since this was me checking the EDR equivalent rather than connecting directly to the host. I would also note down the exact commands shown in the terminal history that the threat actor ran. Then include the queries run on the SIEM and Email Tool to check for scope and entry vector. As well as including the value of any IP or Hash that was brought up. I also noticed that in the case management, I marked it as a True Positive, but realistically, I would mark this as a False Positive and recommend adding cobalt to the title. The case management didn’t list the trigger reason, so I can’t comment on that.<\/p>\n\n\n\n
Affected systems and users\n\nEndpoint\/SRC IP: 172.16.17.55\nC2 IP: 120.79.181.138\nHostname: Alex - HP\nIP Connected to LOLB: 221.181.185.200\n\nSteps taken in the investigation\nRan hash in Virustotal. It was flagged as Malicious by 67 vendors. Hybrid analysis reports as malicious. Any.run has reports on the executable. Internal Threat Intelligence returned no data.\nChecking the endpoint, Network activity shows that the last IP contacted has a history of being used as a Cobalt Strike C2 server. The endpoint contacted a C2 on March 15th, 2021. Important to note that the last login date is December 22, 2020.\nTerminal History shows suspicious activity using LOLB techniques dating back to December 2020, which may be part of this current alert, as I wasn\u2019t able to find how the Cobalt Strike script got onto the system. Attempted to look for the file name in logs and emails.\n\nActions taken\nContained Endpoint\n\nReferences\nhttps://www.virustotal.com\/gui\/file\/b9321c27be4295c15d7f92fafc20d7ccac5f21204b79ebc2fed583dda0197cf9\/detection\nhttps:\/\/www.virustotal.com\/gui\/ip-address\/120.79.181.138\/community\nhttps:\/\/www.virustotal.com\/gui\/ip-address\/221.181.185.200\/community\nhttps:\/\/app.any.run\/tasks\/39e84711-2652-41b1-ad67-e2198baf2f43\/\nhttps:\/\/www.hybrid-analysis.com\/search?query=+24d99ba5654cdf31141c66fd9417b7e0 \n\n----------- (Artifacts below were separate from notes but input into case management)\n\nExtracted Artifacts:\n\nType Value Comment\nMD5 Hash 24d99ba5654cdf31141c66fd9417b7e0\nIP Address 120.79.181[.]138\tC2 IP\nIP Address 221.181.185[.]200\tLOLB IP\nRequested URL 1: hxxps[:\/\/]221[.]181[.]185[.]200:8080\/services[.]exe\nRequested URL 2: hxxps[:\/\/]221[.]181[.]185[.]200:8080\/svchosts[.]exe\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Additional Info:Date of Investigation: Aug, 29, 2024, 11:15 PMAlert Title: Meterpreter or Empire activity detectedTime to investigate: 42 Minutes Retrospective Note:If I were to revisit this today, I’d use more accurate wording on the specific tool being used. For example, instead of “Checking the endpoint”, I would say “After checking the endpoint security tool\/module…”, since this was me checking the EDR equivalent rather than connecting directly to the host. I would also note down the exact commands shown in the terminal history that the threat actor ran. Then include the queries run on the SIEM and Email Tool to check<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"class_list":["post-1179","page","type-page","status-publish","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t