carbanak_master.txt

rule attackatz
{
	meta:
		author = "MITRE Engenuity"
		date = "2/15/2021"
		description = "Used to detect strings associated with attackkatz.exe"
	
    strings:
        $katz1 = "NTPASSWORDHISTORY"
		$katz2 = "LMPASSWORDHISTORY"
		$katz3 = "NTPASSWORD"
		$katz4 = "LMPASSWORD"
		$katz5 = "mimikatz" nocase
		$katz6 = "AcquireCredentialsHandleW"
		$katz7 = "CreateProcess"
		$katz8 = "CreateRemoteThread"
		$katz9 = "CredentialKeys"
		$katz10 = "CredEnumerateW"
		$katz11 = "CredFree"
		$katz12 = "CredIsMarshaledCredentialW"
		$katz13 = "CredUnmarshalCredentialW"
		$katz14 = "CryptAcquireCertificatePrivateKey"
		$katz15 = "DeleteSecurityContext"
		$katz16 = "DuplicateTokenEx"
		$katz17 = "FreeCredentialsHandle"
		$katz18 = "GetSystem"
		$katz19 = "IsDebuggerPresent"
		$katz20 = "LsaCallAuthenticationPackage"
		$katz21 = "LsaClose"
		$katz22 = "LsaEnumerateTrustedDomainsEx"
		$katz23 = "LsaFreeMemory"
		$katz24 = "LsaFreeReturnBuffer"
		$katz25 = "LsaOpen"
		$katz26 = "LsaQuery"
		$katz27 = "OpenThreadToken"
		$katz28 = "SamConnect"
		$katz29 = "SamEnumerate"
		$katz30 = "SamGetMembers"
		$katz31 = "SamiChangePasswordUser"
		$katz32 = "SamLookup"
		$katz33 = "SamOpen"
		$katz34 = "VirtualAlloc"
		$katz35 = "SamCloseHandle"
		
    condition:
        all of them
}


rule http_rat
{
	meta:
		author = "MITRE Engenuity"
		date = "2/15/2021"
		description = "Used to detect strings associated with http-rat.js"
	
    strings:
        $execShellCommand1 = "echo '[+] Upload Complete' >"
		$execShellCommand3 = "enum-system"
		$sleep1 = "jitter = Math.round(Math.random()*(max-min)+min)"
		$lhost1 = "LHOST ="
		$lhost2 = "url = LHOST + url"
        $output1 = "Computer name:"
		$output2 = "Domain:"
		$output3 = "Username:"
		$output4 = "OS-bit:"
		$output5 = "OS Name: "
		$output6 = "Version: "
		$output7 = "Service Pack: "
		$output8 = "OS Manufacturer: "
		$output9 = "Windows Directory: "
		$output10 = "Locale: "
		$output11 = "Available Physical Memory: "
		$output12 = "Total Virtual Memory: "
		$output13 = "Available Virtual Memory: "

    condition:
        all of them
}

rule javaupdate
{
	meta:
		author = "MITRE Engenuity"
		date = "2/15/2021"
		description = "Used to detect strings associated with java-update.exe"
	
    strings:
        $javaupdate1 = "pashulke67@gmail.com"
		$javaupdate2 = "Bargaining active"
		$javaupdate3 = "200416180203Z"
		$javaupdate4 = "www.bargaining-active.com"
        $javaupdate5 = "kernel32.dll" nocase
		$javaupdate6 = "advapi32.dll" nocase
		$javaupdate7 = "ntdll.dll" nocase
		$javaupdate8 = "metsrv.dll" nocase
		$javaupdate9 = "WS2_32.dll" nocase
		$javaupdate10 = "CRYPT32.dll" nocase
		$javaupdate11 = "WININET.dll" nocase
		$javaupdate12 = "WINHTTP.dll" nocase
		$javaupdate13 = "USER32.dll" nocase
		$javaupdate14 = "ole32.dll" nocase
		$javaupdate15 = "msvcrt.dll" nocase
		$javaupdate16 = "CreateThread"
		$javaupdate17 = "CreateToolhelp32Snapshot"
		$javaupdate18 = "CryptEncrypt"
		$javaupdate19 = "IsDebuggerPresent"
		$javaupdate20 = "TlsAlloc"
		$javaupdate21 = "TlsFree"
		$javaupdate22 = "TlsGetValue"
		$javaupdate23 = "TlsSetValue"
		$javaupdate24 = "VirtualAlloc"
		$javaupdate25 = "WinHttp"
		$javaupdate26 = "WriteProcessMemory"

    condition:
        all of them
}

rule keylogger
{
	meta:
		author = "MITRE Engenuity"
		date = "2/15/2021"
		description = "Used to detect strings associated with keylogger.exe"
	
    strings:
        $keylogger1 = "Error, too many arguments."
		$keylogger2 = "Starting KeyCapture to file"
		$keylogger3 = "Failed to get handle from SetWindowsHookEx()"
		$keylogger4 = "KeyCapture handle ready"
		$keylogger5 = "test.log"
		$keylogger6 = "SetWindowsHookEx-Keylogger.pdb"

    condition:
        all of them
}

rule tiny
{
	meta:
		author = "MITRE Engenuity"
		date = "2/15/2021"
		description = "Used to detect strings associated with tiny.exe"
	
    strings:
        $tiny1 = "tiny.exe" nocase
		$tiny2 = "lhost" nocase
		$tiny3 = "lport" nocase
		$tiny4 = "GetCurrentProcess" nocase
		$tiny5 = "GetCurrentProcessId" nocase
		$tiny6 = "GetCurrentThreadId" nocase
		$tiny7 = "Sleep" nocase
		$tiny8 = "TerminateProcess" nocase
		$tiny9 = "TlsGetValue" nocase
		$tiny10 = "UnhandledExceptionFilter" nocase
		$tiny11 = "VirtualAlloc" nocase
		$tiny12 = "VirtualProtect" nocase
		$tiny13 = "VirtualQuery" nocase
		$tiny14 = "WideCharToMultiByte" nocase
		$tiny15 = "Unable to initialize winsock" nocase
		$tiny16 = "Unable to get hostname" nocase
		$tiny17 = "Unable to create socket" nocase
		$tiny18 = "Unable to connect to remote server" nocase
		$tiny19 = "Connecting to control server" nocase
		$tiny20 = "Argument domain error (DOMAIN)" nocase
		$tiny21 = "Argument singularity (SIGN)" nocase
		$tiny22 = "Overflow range error (OVERFLOW)" nocase
		$tiny23 = "Partial loss of significance (PLOSS)" nocase
		$tiny24 = "Total loss of significance (TLOSS)" nocase
		$tiny25 = "The result is too small to be represented (UNDERFLOW)" nocase
		$tiny26 = "_matherr(): %s in %s(%g, %g)  (retval=%g)" nocase
		$tiny27 = "Mingw-w64 runtime failure:" nocase
		$tiny28 = "Address %p has no image-section" nocase
		$tiny29 = "VirtualQuery failed for %d bytes at address %p" nocase
		$tiny30 = "VirtualProtect failed with code 0x%x" nocase
		$tiny31 = "Unknown pseudo relocation protocol version %d." nocase
		$tiny32 = "Unknown pseudo relocation bit size %d." nocase

    condition:
        all of them
}

rule dumpWebCreds
{
	meta:
		author = "MITRE Engenuity"
		date = "2/15/2021"
		description = "Used to detect strings associated with dumpWebCreds.exe"
	
    strings:
        $dumpwebcreds1 = "<GetCreds>g__GetVaultElementValue|0_0"
        $dumpwebcreds3 = "VAULT_SCHEMA_ELEMENT_ID"
        $dumpwebcreds4 = "VAULT_ELEMENT_TYPE"
        $dumpwebcreds5 = "VAULT_ITEM"
        $dumpwebcreds6 = "VAULT_ITEM_ELEMENT"
        $dumpwebcreds7 = "vaultGuid"
        $dumpwebcreds8 = "vaultHandle"
        $dumpwebcreds9 = "get_Value"
        $dumpwebcreds10 = "GetValue"
        $dumpwebcreds11 = "webCreds.exe"
        $dumpwebcreds12 = "VaultCli"
        $dumpwebcreds13 = "vaultcli.dll"
        $dumpwebcreds14 = "get_Item"
        $dumpwebcreds15 = "VaultGetItem"
        $dumpwebcreds16 = "vaultItem"
        $dumpwebcreds17 = "System"
        $dumpwebcreds18 = "Enum"
        $dumpwebcreds19 = "TimeStamp"
        $dumpwebcreds20 = "webCreds"
        $dumpwebcreds21 = "GetCreds"
        $dumpwebcreds22 = "VaultEnumerateItems"
        $dumpwebcreds23 = "VaultEnumerateVaults"
        $dumpwebcreds24 = "VaultCloseVault"
        $dumpwebcreds25 = "VaultOpenVault"
        $dumpwebcreds26 = "vaultItemCount"
        $dumpwebcreds27 = "vaultCount"
        $dumpwebcreds28 = "webCreds.pdb"

    condition:
        all of them
}