Skip to content
This repository was archived by the owner on Nov 16, 2023. It is now read-only.

Commit b11bae2

Browse files
tali-ashtali-ash
authored
Merge pull request #233 from martyav/doppelpaymer
files related to doppelpaymer
2 parents d0d766e + 8770825 commit b11bae2

4 files changed

Lines changed: 216 additions & 0 deletions

File tree

‎Credential Access/doppelpaymer-procdump.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Detect DoppelPaymer operators dumping credentials with ProcDump
2+
3+
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
4+
5+
[DoppelPaymer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372) is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as [ProcDump](https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) to dump credentials from [LSASS](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection). They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.
6+
7+
The following query detects ProcDump being used to dump credentials from LSASS.
8+
9+
The [See also](#See-also) section below lists links to other queries associated with DoppelPaymer.
10+
11+
## Query
12+
13+
```Kusto
14+
// Dumping of LSASS memory using procdump
15+
DeviceProcessEvents
16+
| where Timestamp > ago(7d)
17+
// Command lines that include "lsass" and -accepteula or -ma flags used in procdump
18+
| where (ProcessCommandLine has "lsass" and (ProcessCommandLine has "-accepteula" or
19+
ProcessCommandLine contains "-ma"))
20+
// Omits possible FPs where the full command is just "procdump.exe lsass"
21+
or (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')
22+
```
23+
24+
## Category
25+
26+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
27+
28+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
29+
|-|-|-|
30+
| Initial access | | |
31+
| Execution | | |
32+
| Persistence | | |
33+
| Privilege escalation | | |
34+
| Defense evasion | | |
35+
| Credential Access | v | |
36+
| Discovery | | |
37+
| Lateral movement | | |
38+
| Collection | | |
39+
| Command and control | | |
40+
| Exfiltration | | |
41+
| Impact | | |
42+
| Vulnerability | | |
43+
| Misconfiguration | | |
44+
| Malware, component | | |
45+
46+
## See also
47+
48+
* [Detect DoppelPaymer performing reconnaissance with net.exe](../Discovery/doppelpaymer.md)
49+
* [Detect DoppelPaymer operators spreading files with PsExec](../Lateral%20Movement/doppelpaymer-psexec.md)
50+
* [Detect DoppelPaymer operators stopping services](../Defense%20evasion/doppelpaymer-stop-services.md)
51+
52+
## Contributor info
53+
54+
**Contributor:** Microsoft Threat Protection team

‎Defense evasion/doppelpaymer-stop-services.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Detect DoppelPaymer operators stopping services
2+
3+
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
4+
5+
[DoppelPaymer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372) is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.
6+
7+
The following query detects attempts to stop security services.
8+
9+
The [See also](#See-also) section below lists links to other queries associated with DoppelPaymer.
10+
11+
## Query
12+
13+
```Kusto
14+
// Attempts to stop services and allow ransomware execution
15+
DeviceProcessEvents
16+
| where Timestamp > ago(7d)
17+
| where InitiatingProcessFileName startswith "psexe" and FileName =~ "powershell.exe" and
18+
ProcessCommandLine has "stop-service"
19+
and ProcessCommandLine has "sql" and ProcessCommandLine has "msexchange"
20+
```
21+
22+
## Category
23+
24+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
25+
26+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
27+
|-|-|-|
28+
| Initial access | | |
29+
| Execution | v | |
30+
| Persistence | | |
31+
| Privilege escalation | | |
32+
| Defense evasion | v | |
33+
| Credential Access | | |
34+
| Discovery | | |
35+
| Lateral movement | | |
36+
| Collection | | |
37+
| Command and control | | |
38+
| Exfiltration | | |
39+
| Impact | | |
40+
| Vulnerability | | |
41+
| Misconfiguration | | |
42+
| Malware, component | | |
43+
44+
## See also
45+
46+
* [Detect DoppelPaymer performing reconnaissance with net.exe](../Discovery/doppelpaymer.md)
47+
* [Detect DoppelPaymer operators spreading files with PsExec](../Lateral%20Movement/doppelpaymer-psexec.md)
48+
* [Detect DoppelPaymer operators dumping credentials with ProcDump](../Credential%20Access/doppelpaymer-procdump.md)
49+
50+
## Contributor info
51+
52+
**Contributor:** Microsoft Threat Protection team

‎Discovery/doppelpaymer.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Detect DoppelPaymer performing reconnaissance with net.exe
2+
3+
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
4+
5+
[DoppelPaymer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372) is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they may use *net.exe* to run reconnaissance and find service accounts to target. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.
6+
7+
The following query detects the *net.exe* reconnaissance method described above.
8+
9+
The [See also](#See-also) section below lists links to other queries associated with DoppelPaymer.
10+
11+
## Query
12+
13+
```Kusto
14+
// Finds Net commands used to locate high-value accounts
15+
DeviceProcessEvents
16+
| where Timestamp > ago(7d)
17+
| where FileName == "net.exe"
18+
// Create a set for the command lines
19+
| summarize makeset(ProcessCommandLine) by DeviceId, bin(Timestamp, 5m)
20+
// Other process launches by Net in that same timeframe
21+
| where (set_ProcessCommandLine has "admin"
22+
and set_ProcessCommandLine has_any("domain", "enterprise", "backup operators"))
23+
and set_ProcessCommandLine has "group" and set_ProcessCommandLine contains "/do"
24+
```
25+
26+
## Category
27+
28+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
29+
30+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
31+
|-|-|-|
32+
| Initial access | | |
33+
| Execution | | |
34+
| Persistence | | |
35+
| Privilege escalation | | |
36+
| Defense evasion | | |
37+
| Credential Access | | |
38+
| Discovery | v | |
39+
| Lateral movement | v | |
40+
| Collection | | |
41+
| Command and control | | |
42+
| Exfiltration | | |
43+
| Impact | | |
44+
| Vulnerability | | |
45+
| Misconfiguration | | |
46+
| Malware, component | | |
47+
48+
## See also
49+
50+
* [Detect DoppelPaymer operators spreading files with PsExec](../Lateral%20Movement/doppelpaymer-psexec.md)
51+
* [Detect DoppelPaymer operators stopping services](../Defense%20evasion/doppelpaymer-stop-services.md)
52+
* [Detect DoppelPaymer operators dumping credentials with ProcDump](../Credential%20Access/doppelpaymer-procdump.md)
53+
54+
## Contributor info
55+
56+
**Contributor:** Microsoft Threat Protection team

‎Lateral Movement/doppelpaymer-psexec.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Detect DoppelPaymer operators spreading files with PsExec
2+
3+
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
4+
5+
[DoppelPaymer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372) is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization. More specifically, they use common remote execution tools, such as [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec), to move laterally and distribute ransomware.
6+
7+
The following query detects suspicious usage of PsExec to create files on a remote device.
8+
9+
The [See also](#See-also) section below lists links to other queries associated with DoppelPaymer.
10+
11+
## Query
12+
13+
```Kusto
14+
// PsExec creating files on remote machines
15+
DeviceProcessEvents
16+
| where Timestamp > ago(7d)
17+
| where InitiatingProcessFileName startswith "psexe"
18+
| summarize CommandCount = dcount(ProcessCommandLine), makeset(ProcessCommandLine),
19+
makeset(FileName) by DeviceId, bin(Timestamp, 1d)
20+
| where CommandCount > 2
21+
| where set_ProcessCommandLine has "copy"
22+
```
23+
24+
## Category
25+
26+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
27+
28+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
29+
|-|-|-|
30+
| Initial access | | |
31+
| Execution | | |
32+
| Persistence | | |
33+
| Privilege escalation | | |
34+
| Defense evasion | | |
35+
| Credential Access | | |
36+
| Discovery | | |
37+
| Lateral movement | v | |
38+
| Collection | | |
39+
| Command and control | | |
40+
| Exfiltration | | |
41+
| Impact | | |
42+
| Vulnerability | | |
43+
| Misconfiguration | | |
44+
| Malware, component | | |
45+
46+
## See also
47+
48+
* [Detect DoppelPaymer performing reconnaissance with net.exe](../Discovery/doppelpaymer.md)
49+
* [Detect DoppelPaymer operators stopping services](../Defense%20evasion/doppelpaymer-stop-services.md)
50+
* [Detect DoppelPaymer operators dumping credentials with ProcDump](../Credential%20Access/doppelpaymer-procdump.md)
51+
52+
## Contributor info
53+
54+
**Contributor:** Microsoft Threat Protection team

0 commit comments

Comments
 (0)