All four vulnerabilities and related exploitation techniques have been unknown to the public and were used by the attackers at least since the beginning of January this year. We wrote YARA signatures to detect the exploitation attempts in Exchange web service logs and published Sigma rule that looks for more indicators in Exchange server logs.
The new rules will be available on 4th of March.
We recommend scanning with the “–sigma” command line flag to apply Sigma rules during Logscan and Eventlog scanning.
The mentioned web shells are already covered by existing rules.
Look for the following keywords in THOR log data
- Webshell + Tiny
The web shells samples mentioned by Microsoft as a hash cannot be found in public databases (e.g. Virustotal). We can only guess the current coverage and add a new rule to the rule set of tomorrow:
Detection rate of some of the web shells on Virustotal:
LSASS Process Memory Dumping
Looks for the following keywords in your THOR Logs:
- ‘Suspicious Use of Procdump’ (Sigma)
- ‘Process Dump via Rundll32 and Comsvcs.dll’ (Sigma)
- ‘LSASS process memory dump’ (Filename IOC)
Look for the following keywords:
- ‘Malicious Nishang PowerShell Commandlets’ (Sigma)
We wrote a new rule for PowerCat and Nishangs PowerShell tool to achieve a better coverage:
Both new rules will be available on 4th of March.