Analyzing Sysmon From Backdoored UltraVNC Malware - HTB Sherlocks - Unit42

Name: Analyzing Sysmon From Backdoored UltraVNC Malware - HTB Sherlocks - Unit42
Uploaded: 2024-10-21T10:00:03Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Going over the Unit42 Research that was posted to GitHub 02:30 - Downloading Chainsaw which is what we will use to parse th...

IppSec · Beginner ·📄 Research Papers Explained ·1y ago

00:00 - Introduction 01:00 - Going over the Unit42 Research that was posted to GitHub 02:30 - Downloading Chainsaw which is what we will use to parse the eventlog 03:20 - Running the hunt operation with chainsaw and default sigma rules to see some suspicious events quickly 05:45 - Using the search functionality to show us events with the process guid to show us what the suspicious file did 12:55 - Question 1: How many event ID 11's are there, counting each Event ID 16:00 - Adding each Sysmon event name into our csv file 19:45 - Question 2: Identifying the malicious process, showing all process…

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Introduction

1:00 Going over the Unit42 Research that was posted to GitHub

2:30 Downloading Chainsaw which is what we will use to parse the eventlog

3:20 Running the hunt operation with chainsaw and default sigma rules to see some s

5:45 Using the search functionality to show us events with the process guid to show

12:55 Question 1: How many event ID 11's are there, counting each Event ID

16:00 Adding each Sysmon event name into our csv file

19:45 Question 2: Identifying the malicious process, showing all process creation ev

21:00 Question 3: Finding out how the malware was downloaded by looking at DNS Event

24:23 Question 4: Searching for file time stomping events to see the create time was

25:45 Question 5: Finding events related to once.cmd and seeing what created it

28:30 Question 6: Looking at the DNS Queries for the malware to see the domain it us

29:15 Question 7: Searching network connections from the malware to see where it rea

29:45 Question 8: Seeing where the process terminated itself

31:10 Doing some bashful to see all the Sysmon rulenames a process triggered to get

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →