N?noobquestions
← Back to all guides
Cybersecurity·Mar 12, 2023

Investigate a Compromised Exchange Server using SIEM and Sysmon

Microsoft Exchange Server is commonly deployed in an enterprise, offering email, contact management, calendar, scheduling services, and more. As Microsoft Exchange Server provides critical services and stores sensitive information such as email messages, attachments, events, contacts, and notes, it is often targeted by

Microsoft Exchange Server is commonly deployed in an enterprise, offering email, contact management, calendar, scheduling services, and more. As Microsoft Exchange Server provides critical services and stores sensitive information such as email messages, attachments, events, contacts, and notes, it is often targeted by a ransomware attack.

The TryHackMe Room — Conti allows us to investigate a ransomware attack on an Exchange Server. We are provided with SIEM (Splunk) access, and the task is identifying the attack pattern. In this article, we investigate the use of Splunk query and Sysmon properties to identify the action performed by an attacker.

TryHackMe Room: Conti
https://tryhackme.com/room/contiransomwarehgh

Part 1: Identify the ransomware location

Sysmon Event ID 11: FileCreate

According to Sysmon documentation, Event ID 11: FileCreate refers to creating or overwriting a file. The file may be launched from a user directory.

Sysmon Event ID 11: FileCreate
Sysmon Event ID 11: FileCreate

With reference to MITRE ATT&CK, file creation typically occurs during the Execution stage.

As per MITRE, adversaries adopt multiple techniques in the Execution stage. Malicious file can be one of those.
As per MITRE, adversaries adopt multiple techniques in the Execution stage. Malicious file can be one of those.

Splunk query: sysmon EventCode=11

Search for Sysmon EventCode 11: File Create on Splunk
Search for Sysmon EventCode 11: File Create on Splunk

Looking at the image location, c:\Users\Administrato\Documents\cmd.exe is out of the ordinary because the binary was executed in a user directory.

A suspicious cmd.exe can be found related to Sysmon EventID 11: FileCreate
A suspicious cmd.exe can be found related to Sysmon EventID 11: FileCreate

Further looking into it, the process was marked by Sysmon with the rule: DefaultUserModified. The command tried to change the Windows user profile.

The suspicious cmd.exe was marked with the rule: DefaultUserModified by Sysmon
The suspicious cmd.exe was marked with the rule: DefaultUserModified by Sysmon

As in the query, the Sysmon Event ID is 11: FileCreate

EventCode 11 FileCreate is found in the log
EventCode 11 FileCreate is found in the log

Part 2: Find the hash of the suspicious file

Now that we have the location of the suspicious binary file, we can look into the hash value of the file.

Sysmon Event ID 1: Process Creation

Sysmon Event ID 1: Process Creation contains logs regarding a newly created process, including the hash values of files.

Sysmon Event ID 1: Process Creation
Sysmon Event ID 1: Process Creation

Splunk query: sysmon EventCode=1 Image=”C:\\Users\\Administrator\\Documents\\cmd.exe”

Search for Sysmon EventCode 1: Process Creation events
Search for Sysmon EventCode 1: Process Creation events

We can combine EventCode=1 Process creation with the path of the suspicious binary to search for related events on Splunk.

A related log is displayed. The hash value (290C7DFB01E50CEA9E19DA81A781AF2C) was logged by Sysmon, which can be seen in the “Hashes” Field on Splunk.

MD5 hash value of the cmd.exe file were logged by Sysmon with Event Code 1 Process Creation
MD5 hash value of the cmd.exe file were logged by Sysmon with Event Code 1 Process Creation

Part 3: Locate a file saved to multiple locations

Sysmon Event ID 11: FileCreate

Again, Event ID 11: FileCreate refers to creating or overwriting a file.

Sysmon Event ID 11: FileCreate
Sysmon Event ID 11: FileCreate

Splunk query: sysmon EventCode=11 “c:\\Users\\Administrator\\Documents\\cmd.exe”

Combining Event ID 11: FileCreate and the path of the suspicious binary, it is found that files named “readme.txt” were created on multiple directories.

Multiple readme.txt are present in the system
Multiple readme.txt are present in the system

Part 4: Find the command executed by an attacker for adding a Windows user

Sysmon Event ID 1: Process Creation

Again, Sysmon Event ID 1: Process Creation contains logs regarding a newly created process, which includes the execution of a command to creating a user.

Sysmon Event ID 1: Process Creation
Sysmon Event ID 1: Process Creation

Splunk query: EventCode=1 user add

Using “user add” as a keyword to search on Splunk
Using “user add” as a keyword to search on Splunk

In the ParentCommandLine field, three commands were executed.

ParentCommandLine field
ParentCommandLine field

“net user /add securityninja hardToHack123$” was executed to add a user to Windows. The other commands were used to add the user to Windows administrator group and assign it with RDP capability.

net user command was used to add a Windows user account and assign permissions
net user command was used to add a Windows user account and assign permissions

Part 5: Locate migrated and original processes

Sysmon Event ID 8: Process Creation

Event ID 8: Process Creation in Sysmon provides information regarding source and target processes.

Sysmon Event ID 8: CreateRemoteThread
Sysmon Event ID 8: CreateRemoteThread

Splunk query: EventCode=8

Searching for EventCode 8: Process Creation on SIEM, we can check if an existing process creates a new process.

Sysmon Event ID 8: CreateRemoteThread is added to Splunk query
Sysmon Event ID 8: CreateRemoteThread is added to Splunk query

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\wbem\unsecapp.exe

Two executables were used during remote thread creation
Two executables were used during remote thread creation

Part 6: Locate the process image for getting system hashes

The same Splunk query: EventCode=8 gives another log suggesting that lsass.exe was involved in the remote thread.

C:\Windows\System32\lsass.exe

The target executable Isass.exe was involved in generating a remote thread
The target executable Isass.exe was involved in generating a remote thread

Part 7: Identify the source of a web shell exploit

Sysmon includes a mechanism detecting Metasploit-related events. As web shell exploits are commonly used by hacking tools such as Metasploit, the keyword can be included in the Splunk query to identify events related to web shell exploit.

Illustration for Investigate a Compromised Exchange Server using SIEM and Sysmon

Splunk Query: sysmon RuleName=”Alert,Metasploit”

A Sysmon RuleName: Metasploit is included in Splunk query
A Sysmon RuleName: Metasploit is included in Splunk query

From the “SourceIP” field, an IP address — 10.10.10.6 is found to be related to Metasploit.

An host (IP address: 10.10.10.6) is found running Metasploit
An host (IP address: 10.10.10.6) is found running Metasploit

As the web server in the compromised Microsoft Exchange Server is running IIS and ASP.NET web application (ASPX), we use another Splunk query to narrow down the results and identify the activities performed by the remote host — 10.10.10.6.

Splunk Query: 10.10.10.6 aspx

Look for the IP address running Metasploit and aspx keyword
Look for the IP address running Metasploit and aspx keyword

From the cs_uri_stem field, a value /owa/auth/i3gfPctK1c2x.aspx is found. It means that the remote host running Metasploit — 10.10.10.6 is trying to access this website section.

The web path was accessed by an attacker
The web path was accessed by an attacker

Expanding the logs, the command line that executed the web shell can be found:
attrib.exe -r \\\\win-aoqkg2as2q7.bellybear.local\C$\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\i3gfPctK1c2x.aspx

The remote web shell command executed by an attacker
The remote web shell command executed by an attacker

Part 8: Find out the CVE used in the exploit

CVE information can be found in threat intelligence sources such as web blogs and vulnerability scanning tools. According to Tenable, multiple CVEs are related to the Conti Ransomware Attack.

CVE-2020–0796,CVE-2018–13374,CVE-2018–13379

https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates

CVE information for Conti collected from Threat Intelligence Source — Tenable
CVE information for Conti collected from Threat Intelligence Source — Tenable

References

Sysmon Utility:
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
MITTRE ATT&CK
https://attack.mitre.org/#
Investigating Conti Ransomware on Microsoft Exchange with Splunk | TryHackMe
https://www.youtube.com/watch?v=XaF_pk-0UcI
Tenable — ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware — How Tenable Can Help
https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates

Community discussion

Comments

0 comments

Ask a question or share a practical note. Comments appear immediately after passing the spam check.

Loading comments…

Be constructive and specific.