Skip to content
This repository was archived by the owner on Nov 16, 2023. It is now read-only.

Commit 9b6a3ad

Browse files
tali-ashtali-ash
authored
Merge pull request #182 from martyav/bluekeep-exploit
Bluekeep exploit queries
2 parents a49090c + d69c608 commit 9b6a3ad

File tree

4 files changed

+217
-0
lines changed

4 files changed

+217
-0
lines changed

‎Command and Control/c2-bluekeep.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Detect command-and-control communication related to BlueKeep cryptomining
2+
3+
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
4+
5+
[CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708), also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare [advisory](https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/) about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to [install cryptocurrency miners](https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/) on targets.
6+
7+
Microsoft has issued [updates](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708) for this vulnerability, as well as [guidance](https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708) for protecting operating systems that we no longer support. Microsoft Defender ATP also contains [behavioral detections](https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/) for defending against this threat.
8+
9+
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
10+
11+
## Query
12+
13+
```Kusto
14+
// Suggest setting Timestamp starting from September 6th
15+
// when the BlueKeep Metasploit module was released
16+
let IPs = pack_array("109.176.117.11", "5.100.251.106",
17+
"217.23.5.20", "5.135.199.19");
18+
DeviceNetworkEvents
19+
| where Timestamp > ago(7d)
20+
| where RemoteIP in(IPs)
21+
```
22+
23+
## Category
24+
25+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
26+
27+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
28+
|------------------------|----------|-------|
29+
| Initial access | | |
30+
| Execution | | |
31+
| Persistence | | |
32+
| Privilege escalation | | |
33+
| Defense evasion | | |
34+
| Credential Access | | |
35+
| Discovery | | |
36+
| Lateral movement | | |
37+
| Collection | | |
38+
| Command and control | v | |
39+
| Exfiltration | | |
40+
| Impact | | |
41+
| Vulnerability | | |
42+
| Misconfiguration | | |
43+
| Malware, component | | |
44+
45+
## See also
46+
47+
* [Detect BlueKeep-related mining](../Execution/detect-bluekeep-related-mining.md)
48+
* [Detect BlueKeep exploitation attempts](../Initial%20access/detect-bluekeep-exploitation-attempts.md)
49+
* [Detect suspicious RDP activity related to BlueKeep](..\Lateral%20Movement\detect-suspicious-rdp-connections.md)
50+
51+
## Contributor info
52+
53+
**Contributor:** Microsoft Threat Protection team

‎Execution/detect-bluekeep-related-mining.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Detect BlueKeep-related cryptocurrency mining
2+
3+
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
4+
5+
[CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708), also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare [advisory](https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/) about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to [install cryptocurrency miners](https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/) on targets.
6+
7+
Microsoft has issued [updates](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708) for this vulnerability, as well as [guidance](https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708) for protecting operating systems that we no longer support. Microsoft Defender ATP also contains [behavioral detections](https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/) for defending against this threat.
8+
9+
The following query locates devices where the known coin miner payload was dropped.
10+
11+
## Query
12+
13+
```Kusto
14+
// Suggest setting Timestamp starting from September 6th
15+
// when the BlueKeep Metasploit module was released
16+
DeviceFileEvents
17+
| where Timestamp > ago(7d)
18+
| where FolderPath endswith "spool\\svchost.exe"
19+
or SHA1=="82288c2dc5c63c1c57170da91f9979648333658e"
20+
```
21+
22+
## Category
23+
24+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
25+
26+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
27+
|------------------------|----------|-------|
28+
| Initial access | | |
29+
| Execution | v | |
30+
| Persistence | | |
31+
| Privilege escalation | | |
32+
| Defense evasion | | |
33+
| Credential Access | | |
34+
| Discovery | | |
35+
| Lateral movement | | |
36+
| Collection | | |
37+
| Command and control | | |
38+
| Exfiltration | | |
39+
| Impact | | |
40+
| Vulnerability | | |
41+
| Misconfiguration | | |
42+
| Malware, component | | |
43+
44+
## See also
45+
46+
* [Detect BlueKeep exploitation attempts](../Initial%20access/detect-bluekeep-exploitation-attempts.md)
47+
* [Detect suspicious RDP activity related to BlueKeep](..\Lateral%20Movement\detect-suspicious-rdp-connections.md)
48+
* [Detect command-and-control communication related to BlueKeep cryptomining](../Command%20and%20Control/c2-bluekeep.md)
49+
50+
## Contributor info
51+
52+
**Contributor:** Microsoft Threat Protection team

‎Initial access/detect-bluekeep-exploitation-attempts.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Detect BlueKeep exploitation attempts
2+
3+
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
4+
5+
[CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708), also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare [advisory](https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/) about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to [install cryptocurrency miners](https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/) on targets.
6+
7+
Microsoft has issued [updates](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708) for this vulnerability, as well as [guidance](https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708) for protecting operating systems that we no longer support. Microsoft Defender ATP also contains [behavioral detections](https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/) for defending against this threat.
8+
9+
The following query detects devices with RDP connections that could be exploitation attempts.
10+
11+
## Query
12+
13+
```Kusto
14+
DeviceNetworkEvents
15+
| where InitiatingProcessFileName =~ "spoolsv.exe"
16+
| where RemotePort == "3389"
17+
```
18+
19+
## Category
20+
21+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
22+
23+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
24+
|------------------------|----------|-------|
25+
| Initial access | v | |
26+
| Execution | | |
27+
| Persistence | | |
28+
| Privilege escalation | | |
29+
| Defense evasion | | |
30+
| Credential Access | | |
31+
| Discovery | | |
32+
| Lateral movement | v | |
33+
| Collection | | |
34+
| Command and control | | |
35+
| Exfiltration | | |
36+
| Impact | | |
37+
| Vulnerability | | |
38+
| Misconfiguration | | |
39+
| Malware, component | | |
40+
41+
## See also
42+
43+
* [Detect BlueKeep-related mining](../Execution/detect-bluekeep-related-mining.md)
44+
* [Detect command-and-control communication related to BlueKeep cryptomining](../Command%20and%20Control/c2-bluekeep.md)
45+
* [Detect suspicious RDP activity related to BlueKeep](..\Lateral%20Movement\detect-suspicious-rdp-connections.md)
46+
47+
## Contributor info
48+
49+
**Contributor:** Microsoft Threat Protection team

‎Lateral Movement/detect-suspicious-rdp-connections.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Detect suspicious RDP activity related to BlueKeep
2+
3+
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
4+
5+
[CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708), also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare [advisory](https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/) about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to [install cryptocurrency miners](https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/) on targets.
6+
7+
Microsoft has issued [updates](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708) for this vulnerability, as well as [guidance](https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708) for protecting operating systems that we no longer support. Microsoft Defender ATP also contains [behavioral detections](https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/) for defending against this threat.
8+
9+
The following query locates Windows 7 or Windows Server 2008 machines initiating outbound connections to internal or public IP addresses on TCP port 3389. It filters out common RDP programs and scanning tools and shows the number of connections per machine. It can identify machines with relatively intense outbound network activity on the common RDP port (TCP/3389). You can use it to find processes that might be scanning for possible targets or exhibiting worm-like behavior.
10+
11+
## Query
12+
13+
```Kusto
14+
// Find unusual processes on Windows 7 or Windows Server 2008 machines with
15+
// outbound connections to TCP port 3389
16+
let listMachines = DeviceInfo
17+
| where OSVersion == "6.1" //Win7 and Srv2008
18+
| distinct DeviceId;
19+
DeviceNetworkEvents
20+
| where RemotePort == 3389
21+
| where Protocol == "Tcp" and ActionType == "ConnectionSuccess"
22+
| where InitiatingProcessFileName !in~ //filter some legit programs
23+
("mstsc.exe","RTSApp.exe", "RTS2App.exe","RDCMan.exe","ws_TunnelService.exe","RSSensor.exe"
24+
"RemoteDesktopManagerFree.exe","RemoteDesktopManager.exe","RemoteDesktopManager64.exe",
25+
"mRemoteNG.exe","mRemote.exe","Terminals.exe","spiceworks-finder.exe",
26+
"FSDiscovery.exe","FSAssessment.exe")
27+
| join listMachines on DeviceId
28+
| project Timestamp, DeviceId, DeviceName, RemoteIP, InitiatingProcessFileName,
29+
InitiatingProcessFolderPath, InitiatingProcessSHA1
30+
| summarize conn=count() by DeviceId, InitiatingProcessFileName, bin(Timestamp, 1d)
31+
```
32+
33+
## Category
34+
35+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
36+
37+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
38+
|------------------------|----------|-------|
39+
| Initial access | v | |
40+
| Execution | | |
41+
| Persistence | | |
42+
| Privilege escalation | | |
43+
| Defense evasion | | |
44+
| Credential Access | | |
45+
| Discovery | v | |
46+
| Lateral movement | v | |
47+
| Collection | | |
48+
| Command and control | | |
49+
| Exfiltration | | |
50+
| Impact | | |
51+
| Vulnerability | | |
52+
| Misconfiguration | | |
53+
| Malware, component | | |
54+
55+
## See also
56+
57+
* [Detect BlueKeep-related mining](../Execution/detect-bluekeep-related-mining.md)
58+
* [Detect command-and-control communication related to BlueKeep cryptomining](../Command%20and%20Control/c2-bluekeep.md)
59+
* [Detect BlueKeep exploitation attempts](../Initial%20access/detect-bluekeep-exploitation-attempts.md)
60+
61+
## Contributor info
62+
63+
**Contributor:** Microsoft Threat Protection team

0 commit comments

Comments
 (0)