Skip to content

Commit e5ef61b

Browse files
author
Jake Smith
authored
Merge pull request #329 from ION28/develop
Merge of develop into master for v0.4.4-alpha Release
2 parents 9db161c + 292a6a4 commit e5ef61b

File tree

289 files changed

+8897
-6414
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

289 files changed

+8897
-6414
lines changed

‎.github/workflows/cloud-web.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Deploy Project Website to bluespawn.cloud
2+
on:
3+
push:
4+
branches:
5+
- master
6+
- develop
7+
pull_request:
8+
branches:
9+
- master
10+
- develop
11+
12+
jobs:
13+
build:
14+
name: Update Project site
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: SSH into server and update
18+
uses: appleboy/ssh-action@master
19+
with:
20+
host: bluespawn.cloud
21+
username: ubuntu
22+
key: ${{ secrets.PRIVATE_KEY }}
23+
port: 22
24+
script: |
25+
cd ~/BLUESPAWN
26+
git fetch --all
27+
git checkout ${{ github.ref }}
28+
git pull origin ${{ github.ref }}
29+
source ~/venv/bin/activate
30+
cd docs
31+
pip install -r requirements.txt
32+
python3 manage.py makemigrations
33+
python3 manage.py migrate
34+
sudo service uwsgi restart
35+
sudo /etc/init.d/nginx restart
36+
if: github.event_name == 'push'
37+
38+
- name: SSH into server and update
39+
uses: appleboy/ssh-action@master
40+
with:
41+
host: bluespawn.cloud
42+
username: ubuntu
43+
key: ${{ secrets.PRIVATE_KEY }}
44+
port: 22
45+
script: |
46+
cd ~/BLUESPAWN
47+
git fetch --all
48+
git checkout ${{ github.head_ref }}
49+
git pull origin ${{ github.head_ref }}
50+
source ~/venv/bin/activate
51+
cd docs
52+
pip install -r requirements.txt
53+
python3 manage.py makemigrations
54+
python3 manage.py migrate
55+
sudo service uwsgi restart
56+
sudo /etc/init.d/nginx restart
57+
if: github.event_name == 'pull_request'

‎.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,10 @@ BLUESPAWN-client/resources/indicators
1313
*.bak
1414
*.lib
1515
*.aps
16+
17+
# BLUESPAWN Project Site - docs/
18+
*.lock
19+
docs/db.sqlite3
20+
__pycache__/
21+
docs/media/scans/
22+
docs/*/migrations/

‎BLUESPAWN-client/BLUESPAWN-client.exe.manifest‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
3+
<description>BLUESPAWN Active Defense and EDR Software</description>
4+
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
5+
<application>
6+
<!-- Windows 10 -->
7+
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
8+
<!-- Windows 8.1 -->
9+
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
10+
<!-- Windows 8 -->
11+
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
12+
<!-- Windows 7 -->
13+
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
14+
<!-- Windows Vista -->
15+
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
16+
</application>
17+
</compatibility>
18+
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
19+
<security>
20+
<requestedPrivileges>
21+
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
22+
</requestedPrivileges>
23+
</security>
24+
</trustInfo>
25+
</assembly>

‎BLUESPAWN-client/BLUESPAWN-client.vcxproj‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,24 +25,39 @@
2525
<ClInclude Include="headers\hunt\HuntInfo.h" />
2626
<ClInclude Include="headers\hunt\HuntRegister.h" />
2727
<ClInclude Include="headers\hunt\hunts\HuntT1004.h" />
28+
<ClInclude Include="headers\hunt\hunts\HuntT1013.h" />
2829
<ClInclude Include="headers\hunt\hunts\HuntT1015.h" />
30+
<ClInclude Include="headers\hunt\hunts\HuntT1031.h" />
2931
<ClInclude Include="headers\hunt\hunts\HuntT1035.h" />
32+
<ClInclude Include="headers\hunt\hunts\HuntT1036.h" />
3033
<ClInclude Include="headers\hunt\hunts\HuntT1037.h" />
3134
<ClInclude Include="headers\hunt\hunts\HuntT1050.h" />
3235
<ClInclude Include="headers\hunt\hunts\HuntT1053.h" />
3336
<ClInclude Include="headers\hunt\hunts\HuntT1055.h" />
3437
<ClInclude Include="headers\hunt\hunts\HuntT1060.h" />
38+
<ClInclude Include="headers\hunt\hunts\HuntT1068.h" />
39+
<ClInclude Include="headers\hunt\hunts\HuntT1089.h" />
3540
<ClInclude Include="headers\hunt\hunts\HuntT1099.h" />
3641
<ClInclude Include="headers\hunt\hunts\HuntT1100.h" />
3742
<ClInclude Include="headers\hunt\hunts\HuntT1101.h" />
3843
<ClInclude Include="headers\hunt\hunts\HuntT1103.h" />
44+
<ClInclude Include="headers\hunt\hunts\HuntT1122.h" />
45+
<ClInclude Include="headers\hunt\hunts\HuntT1128.h" />
3946
<ClInclude Include="headers\hunt\hunts\HuntT1131.h" />
4047
<ClInclude Include="headers\hunt\hunts\HuntT1136.h" />
4148
<ClInclude Include="headers\hunt\hunts\HuntT1138.h" />
4249
<ClInclude Include="headers\hunt\hunts\HuntT1182.h" />
4350
<ClInclude Include="headers\hunt\hunts\HuntT1183.h" />
51+
<ClInclude Include="headers\hunt\hunts\HuntT1198.h" />
52+
<ClInclude Include="headers\hunt\hunts\HuntT1484.h" />
53+
<ClInclude Include="headers\mitigation\mitigations\MitigateM1028-WFW.h" />
54+
<ClInclude Include="headers\mitigation\mitigations\MitigateM1054-WSC.h" />
4455
<ClInclude Include="headers\mitigation\mitigations\MitigateV71769.h" />
56+
<ClInclude Include="headers\mitigation\mitigations\MitigateV73511.h" />
57+
<ClInclude Include="headers\monitor\EventListener.h" />
4558
<ClInclude Include="headers\reaction\CarveMemory.h" />
59+
<ClInclude Include="headers\reaction\DeleteFile.h" />
60+
<ClInclude Include="headers\reaction\QuarantineFile.h" />
4661
<ClInclude Include="headers\reaction\RemoveValue.h" />
4762
<ClInclude Include="headers\reaction\SuspendProcess.h" />
4863
<ClInclude Include="headers\hunt\RegistryHunt.h" />
@@ -103,6 +118,7 @@
103118
<ClInclude Include="headers\util\log\LogSink.h" />
104119
<ClInclude Include="headers\util\log\ServerSink.h" />
105120
<ClInclude Include="headers\util\log\XMLSink.h" />
121+
<ClInclude Include="headers\util\permissions\permissions.h" />
106122
<ClInclude Include="headers\util\pe\Export_Section.h">
107123
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</ExcludedFromBuild>
108124
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</ExcludedFromBuild>
@@ -144,6 +160,9 @@
144160
<ClInclude Include="headers\reaction\Detections.h" />
145161
<ClInclude Include="headers\reaction\Log.h" />
146162
<ClInclude Include="headers\reaction\Reaction.h" />
163+
<ClInclude Include="headers\util\processes\ParseCobalt.h" />
164+
<ClInclude Include="headers\util\processes\CheckLolbin.h" />
165+
<ClInclude Include="headers\util\processes\CommandParser.h" />
147166
<ClInclude Include="headers\util\processes\PERemover.h" />
148167
<ClInclude Include="headers\util\processes\ProcessChecker.h" />
149168
<ClInclude Include="headers\util\processes\ProcessUtils.h" />
@@ -153,24 +172,39 @@
153172
<ClCompile Include="src\hunt\Hunt.cpp" />
154173
<ClCompile Include="src\hunt\HuntRegister.cpp" />
155174
<ClCompile Include="src\hunt\hunts\HuntT1004.cpp" />
175+
<ClCompile Include="src\hunt\hunts\HuntT1013.cpp" />
156176
<ClCompile Include="src\hunt\hunts\HuntT1015.cpp" />
177+
<ClCompile Include="src\hunt\hunts\HuntT1031.cpp" />
157178
<ClCompile Include="src\hunt\hunts\HuntT1035.cpp" />
179+
<ClCompile Include="src\hunt\hunts\HuntT1036.cpp" />
158180
<ClCompile Include="src\hunt\hunts\HuntT1037.cpp" />
159181
<ClCompile Include="src\hunt\hunts\HuntT1050.cpp" />
160182
<ClCompile Include="src\hunt\hunts\HuntT1053.cpp" />
161183
<ClCompile Include="src\hunt\hunts\HuntT1055.cpp" />
162184
<ClCompile Include="src\hunt\hunts\HuntT1060.cpp" />
185+
<ClCompile Include="src\hunt\hunts\HuntT1068.cpp" />
186+
<ClCompile Include="src\hunt\hunts\HuntT1089.cpp" />
163187
<ClCompile Include="src\hunt\hunts\HuntT1099.cpp" />
164188
<ClCompile Include="src\hunt\hunts\HuntT1100.cpp" />
165189
<ClCompile Include="src\hunt\hunts\HuntT1101.cpp" />
166190
<ClCompile Include="src\hunt\hunts\HuntT1103.cpp" />
191+
<ClCompile Include="src\hunt\hunts\HuntT1122.cpp" />
192+
<ClCompile Include="src\hunt\hunts\HuntT1128.cpp" />
167193
<ClCompile Include="src\hunt\hunts\HuntT1131.cpp" />
168194
<ClCompile Include="src\hunt\hunts\HuntT1136.cpp" />
169195
<ClCompile Include="src\hunt\hunts\HuntT1138.cpp" />
170196
<ClCompile Include="src\hunt\hunts\HuntT1182.cpp" />
171197
<ClCompile Include="src\hunt\hunts\HuntT1183.cpp" />
198+
<ClCompile Include="src\hunt\hunts\HuntT1198.cpp" />
199+
<ClCompile Include="src\hunt\hunts\HuntT1484.cpp" />
200+
<ClCompile Include="src\mitigation\mitigations\MitigateM1028-WFW.cpp" />
201+
<ClCompile Include="src\mitigation\mitigations\MitigateM1054-WSC.cpp" />
172202
<ClCompile Include="src\mitigation\mitigations\MitigateV71769.cpp" />
203+
<ClCompile Include="src\mitigation\mitigations\MitigateV73511.cpp" />
204+
<ClCompile Include="src\monitor\EventListener.cpp" />
173205
<ClCompile Include="src\reaction\CarveMemory.cpp" />
206+
<ClCompile Include="src\reaction\DeleteFile.cpp" />
207+
<ClCompile Include="src\reaction\QuarantineFile.cpp" />
174208
<ClCompile Include="src\reaction\RemoveValue.cpp" />
175209
<ClCompile Include="src\reaction\SuspendProcess.cpp" />
176210
<ClCompile Include="src\hunt\RegistryHunt.cpp" />
@@ -227,6 +261,7 @@
227261
<ClCompile Include="src\util\log\LogLevel.cpp" />
228262
<ClCompile Include="src\util\log\ServerSink.cpp" />
229263
<ClCompile Include="src\util\log\XMLSink.cpp" />
264+
<ClCompile Include="src\util\permissions\permissions.cpp" />
230265
<ClCompile Include="src\util\pe\Export_Section.cpp">
231266
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</ExcludedFromBuild>
232267
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</ExcludedFromBuild>
@@ -267,6 +302,9 @@
267302
<ClCompile Include="src\util\processes\Analyzer.cpp" />
268303
<ClCompile Include="src\reaction\ReactLog.cpp" />
269304
<ClCompile Include="src\reaction\Reaction.cpp" />
305+
<ClCompile Include="src\util\processes\ParseCobalt.cpp" />
306+
<ClCompile Include="src\util\processes\CheckLolbin.cpp" />
307+
<ClCompile Include="src\util\processes\CommandParser.cpp" />
270308
<ClCompile Include="src\util\processes\PERemover.cpp" />
271309
<ClCompile Include="src\util\processes\ProcessUtils.cpp" />
272310
<ClInclude Include="resources\resource.h" />
@@ -286,7 +324,18 @@
286324
<None Include="resources\indicators" />
287325
<None Include="resources\severe" />
288326
<None Include="resources\severe2" />
327+
<None Include="resources\SIP" />
328+
<None Include="resources\TrustProviders" />
289329
</ItemGroup>
330+
<ItemGroup>
331+
<Manifest Include="BLUESPAWN-client.exe.manifest" />
332+
</ItemGroup>
333+
<PropertyGroup>
334+
<GenerateManifest>false</GenerateManifest>
335+
<EmbedManifest>
336+
</EmbedManifest>
337+
<PostBuildEventUseInBuild>true</PostBuildEventUseInBuild>
338+
</PropertyGroup>
290339
<ItemDefinitionGroup>
291340
<BuildLog>
292341
<Path>$(SolutionDir)build\$(PlatformTarget)\$(Configuration)\$(MSBuildProjectName).log</Path>
@@ -297,10 +346,20 @@
297346
<RuntimeLibrary Condition="'$(Configuration)|$(Platform)'=='Release|x64'">MultiThreaded</RuntimeLibrary>
298347
<RuntimeLibrary Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">MultiThreadedDebug</RuntimeLibrary>
299348
<RuntimeLibrary Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">MultiThreadedDebug</RuntimeLibrary>
349+
<ExceptionHandling Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Async</ExceptionHandling>
350+
<ExceptionHandling Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Async</ExceptionHandling>
351+
<ExceptionHandling Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Async</ExceptionHandling>
352+
<ExceptionHandling Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Async</ExceptionHandling>
300353
</ClCompile>
301354
<Link>
302355
<AdditionalDependencies>Secur32.lib;DbgHelp.lib;Wintrust.lib;ws2_32.lib;Crypt32.lib;Shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies>
303356
</Link>
357+
<PostBuildEvent>
358+
<Command>mt.exe -manifest "$(ProjectDir)$(TargetName).exe.manifest" -outputresource:"$(TargetDir)$(TargetName).exe;1"</Command>
359+
</PostBuildEvent>
360+
<PostBuildEvent>
361+
<Message>Adding manifest to BLUESPAWN-client.exe</Message>
362+
</PostBuildEvent>
304363
</ItemDefinitionGroup>
305364
<PropertyGroup Label="Globals">
306365
<ProjectGuid>{159B2E72-9553-4E17-9BEC-CB92FCA8D0B0}</ProjectGuid>

‎BLUESPAWN-client/headers/hunt/Hunt.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@ class HuntRegister;
1515
#define GET_INFO() \
1616
HuntInfo{ this->name, __func__ == std::string{"ScanCursory"} ? Aggressiveness::Cursory : \
1717
__func__ == std::string{"ScanNormal"} ? Aggressiveness::Normal : Aggressiveness::Intensive, \
18-
this->dwTacticsUsed, this->dwCategoriesAffected, this->dwSourcesInvolved, \
19-
(long) std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::system_clock::now().time_since_epoch()).count() }
18+
this->dwTacticsUsed, this->dwCategoriesAffected, this->dwSourcesInvolved }
2019

2120
class Hunt {
2221
protected:

‎BLUESPAWN-client/headers/hunt/HuntInfo.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,6 @@ struct HuntInfo {
5151
DWORD HuntTactics;
5252
DWORD HuntCategories;
5353
DWORD HuntDatasources;
54-
long HuntStartTime;
55-
HuntInfo(const std::wstring& HuntName, Aggressiveness HuntAggressiveness, DWORD HuntTactics, DWORD HuntCategories, DWORD HuntDatasources, long HuntStartTime);
54+
SYSTEMTIME HuntStartTime;
55+
HuntInfo(const std::wstring& HuntName, Aggressiveness HuntAggressiveness, DWORD HuntTactics, DWORD HuntCategories, DWORD HuntDatasources);
5656
};

‎BLUESPAWN-client/headers/hunt/hunts/HuntT1013.h‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#pragma once
2+
#include "../Hunt.h"
3+
#include "reaction/Reaction.h"
4+
#include "reaction/Log.h"
5+
6+
namespace Hunts {
7+
8+
/**
9+
* HuntT1013 examines the registry for bad port monitors
10+
*
11+
* @scans Cursory checks for bad DLLs configured as port monitors
12+
* @scans Normal Scan not supported.
13+
* @scans Intensive Scan not supported.
14+
*/
15+
class HuntT1013 : public Hunt {
16+
public:
17+
HuntT1013();
18+
19+
virtual int ScanCursory(const Scope& scope, Reaction reaction) override;
20+
virtual std::vector<std::shared_ptr<Event>> GetMonitoringEvents() override;
21+
};
22+
}

‎BLUESPAWN-client/headers/hunt/hunts/HuntT1031.h‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#pragma once
2+
#include "../Hunt.h"
3+
#include "reaction/Reaction.h"
4+
#include "reaction/Log.h"
5+
6+
namespace Hunts {
7+
8+
/**
9+
* HuntT1031 examines the registry for additions/changes to Services configured
10+
* in the registry such as an extra Dll it launches based on a specific value
11+
*
12+
* @scans Cursory checks for a ServerLevelPluginDll to be configured on the DNS Service
13+
* @scans Normal Scan not supported.
14+
* @scans Intensive Scan not supported.
15+
*/
16+
class HuntT1031 : public Hunt {
17+
public:
18+
HuntT1031();
19+
20+
virtual int ScanCursory(const Scope& scope, Reaction reaction) override;
21+
virtual std::vector<std::shared_ptr<Event>> GetMonitoringEvents() override;
22+
};
23+
}

‎BLUESPAWN-client/headers/hunt/hunts/HuntT1035.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ namespace Hunts {
1818
*/
1919
class HuntT1035 : public Hunt {
2020
private:
21-
std::vector<std::wstring> vSuspicious = { L"cmd.exe", L"powershell.exe", L"cscript.exe", L"wscript.exe", L"net.exe", L"net1.exe" };
22-
int EvaluateService(Registry::RegistryKey key, Reaction reaction);
21+
22+
int EvaluateService(Registry::RegistryKey key, Reaction& reaction);
2323

2424
public:
2525
HuntT1035();

‎BLUESPAWN-client/headers/hunt/hunts/HuntT1036.h‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#pragma once
2+
#include "../Hunt.h"
3+
#include "reaction/Reaction.h"
4+
#include "reaction/Log.h"
5+
6+
namespace Hunts {
7+
8+
/**
9+
* HuntT1036 examines the local file system for executables in user writable
10+
* locations in %WINDIR%
11+
*
12+
* @scans Cursory checks all such writable folders for executable files
13+
* @scans Normal Scan not supported.
14+
* @scans Intensive Scan not supported.
15+
*/
16+
class HuntT1036 : public Hunt {
17+
private:
18+
std::vector<std::wstring> susExts = { L".bat", L".cmd", L".exe", L".dll", L".js", L".jse",
19+
L".lnk", L".ps1", L".sct", L".vb", L".vbe", L".vbs", L".vbscript", L".hta" };
20+
21+
// Credit: https://twitter.com/mattifestation/status/1172520995472756737/photo/1
22+
std::vector<std::wstring> writableFolders = {
23+
L"%WINDIR%\\System32\\Microsoft\\crypto\\rsa\\machinekeys",
24+
L"%WINDIR%\\System32\\tasks_migrated\\microsoft\\windows\\pla\\system",
25+
L"%WINDIR%\\Syswow64\\tasks\\microsoft\\windows\\pla\\system",
26+
L"%WINDIR%\\debug\\WIA",
27+
L"%WINDIR%\\System32\\Tasks",
28+
L"%WINDIR%\\Syswow64\\Tasks",
29+
L"%WINDIR%\\Tasks",
30+
L"%WINDIR%\\Registration\\crmlog",
31+
L"%WINDIR%\\System32\\com\\dmp",
32+
L"%WINDIR%\\System32\\fxstmp",
33+
L"%WINDIR%\\System32\\spool\\drivers\\color",
34+
L"%WINDIR%\\System32\\spool\\printers",
35+
L"%WINDIR%\\System32\\spool\\servers",
36+
L"%WINDIR%\\Syswow64\\com\\dmp",
37+
L"%WINDIR%\\Syswow64\\fxstmp",
38+
L"%WINDIR%\\Temp",
39+
L"%WINDIR%\\tracing"
40+
};
41+
public:
42+
HuntT1036();
43+
44+
virtual int ScanCursory(const Scope& scope, Reaction reaction) override;
45+
virtual std::vector<std::shared_ptr<Event>> GetMonitoringEvents() override;
46+
};
47+
}

0 commit comments

Comments
 (0)